TLS 1.2 and PFS on 10.2.4

Question

Hi guys,
I have a problem enabling both TLS 1.2 and PFS on a 10.2.4 unit.
Using the following string should do it in theory:
COMPAT:+TLSv1_2:EDH:!MD5:!EXPORT:!ADH:!DES:!RC4:!SSLv3:@STRENGTH
And tmm --clientcipher says it does:
 0:  57 DHE-RSA-AES256-SHA              256  TLS1  Compat AES    SHA    EDH/RSA
 1:  57 DHE-RSA-AES256-SHA              256  DTLS1  Compat AES    SHA    EDH/RSA
 2:  57 DHE-RSA-AES256-SHA              256  TLS1.2  Compat AES    SHA    EDH/RSA
 3:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1  Compat DES    SHA    EDH/RSA
 4:  22 DHE-RSA-DES-CBC3-SHA            192  DTLS1  Compat DES    SHA    EDH/RSA
 5:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1.2  Compat DES    SHA    EDH/RSA
 6:  51 DHE-RSA-AES128-SHA              128  TLS1  Compat AES    SHA    EDH/RSA
 7:  51 DHE-RSA-AES128-SHA              128  DTLS1  Compat AES    SHA    EDH/RSA
 8:  51 DHE-RSA-AES128-SHA              128  TLS1.2  Compat AES    SHA    EDH/RSA

However SSLlabs and other tools say that TLS 1.2 is not supported. Any idea what i'm doing wrong?
Thanks in advance.

what_lies_bene1 · Answer

Hmmm, TLS 1.2 support was introduced with v10.2.3 so this should work. However, I wonder if the use of COMPAT in the issue. Is there a reason you are using it?&nbsp;

lostmyspaceship · Answer

I'm using COMPAT because of the PFS, it seems PFS is not available in the NATIVE stack. It's strange though that with COMPAT tmm says both TLS1.2 and PFS should be there, and they aren't.&nbsp;

ken_schultz_525 · Answer

Wouldn't 
   EDH:!SSLv3:!DES:@STRENGTH 
yield the same results as the string you used, and be simpler? (I don't have a 10.2 box to confirm)&nbsp;
What happens if you test using this one instead
   EDH+TLSv1_2:EDH:!SSLv3:!DES:@STRENGTH&nbsp;

lostmyspaceship · Answer

It seems I have to use either COMPAT, NATIVE, or DEFAULT in order to get any ciphers when I check it withe tmm. I also do not want MD5, RC4, Anon DH and Export grade. Adding all those results in my original string, except the explicit mention of TLSv1_2:
COMPAT:!EXPORT:EDH:!ADH:!MD5:!RC4:!SSLv3:!DES:@STRENGTH

tmm shows TLS 1.2, but SSLLabs and others still do not see it.

tmm --clientcipher 'COMPAT:!EXPORT:EDH:!ADH:!MD5:!RC4:!SSLv3:!DES:@STRENGTH'
         ID SUITE                          BITS  PROT  METHOD CIPHER MAC    KEYX
     0:  57 DHE-RSA-AES256-SHA              256  TLS1  Compat AES    SHA    EDH/RSA
     1:  57 DHE-RSA-AES256-SHA              256  TLS1.2  Compat AES    SHA    EDH/RSA
     2:  57 DHE-RSA-AES256-SHA              256  DTLS1  Compat AES    SHA    EDH/RSA
     3:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1  Compat DES    SHA    EDH/RSA
     4:  22 DHE-RSA-DES-CBC3-SHA            192  TLS1.2  Compat DES    SHA    EDH/RSA
     5:  22 DHE-RSA-DES-CBC3-SHA            192  DTLS1  Compat DES    SHA    EDH/RSA
     6:  51 DHE-RSA-AES128-SHA              128  TLS1  Compat AES    SHA    EDH/RSA
     7:  51 DHE-RSA-AES128-SHA              128  TLS1.2  Compat AES    SHA    EDH/RSA
     8:  51 DHE-RSA-AES128-SHA              128  DTLS1  Compat AES    SHA    EDH/RSA

ken_schultz_525 · Answer

So what does --clientciphers output for you with my suggested cipherstring?&nbsp;

Forum Discussion

TLS 1.2 and PFS on 10.2.4

8 Replies

F5 Academy at AppWorld 2026

Introducing the F5 AI Assistant for BIG-IP

Recent Discussions

Checking for X-Forwarded-For against an Address Data-Group

SSL Bridging and FQDN rewrite Policy

Cisco TACACS+ Config on ISE LTM Pair

iRule causing requests to be duplicated (sometimes)

How can I get started with iCall

Related Content

F5 Server SSL Profile using TLS 1.0 instead of TLS 1.2

Load Balancing TCP TLS Encrypted Syslog Messages

Disable TLS 1.0 and 1.1 protocol on VIPS, Only TLS 1.2 should be on.

Decrypting TLS traffic on BIG-IP

TLS Fingerprinting - a method for identifying a TLS client without decrypting

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS