Forum Discussion

AaronMLong_1021's avatar
AaronMLong_1021
Icon for Cirrus rankCirrus
Feb 18, 2016

TLS support in iRule editor

After updating my supported cipher/protocol list on the default clientssl profile on my BigIP LTM:   NATIVE:!MD5:!EXPORT:!DES:!DHE:!EDH:!RC4:!ADH:!SSLv3:!TLSv1:-RC4:@SPEED   I'm no longer able ...
devops
editor
iRules
  • AaronMLong_1021's avatar
    AaronMLong_1021
    Feb 18, 2016

    Thanks, Kai & Mo. Any chance that better TLS support is going to show up in an upcoming update of the iRule editor? I can certainly use Fiddler to proxy it, but it does seem silly.

     

Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 18, 2016

Hi Aaron,

 

the iRule Editor is unfortunately using very unsecure SSL/TLS libs and/or settings.

 

Beside of the missing TLS1.1, TLS1.2 support, the iRule editor is even not checking for trusted certificates, name matchings, and revocation information. So if security is a concern, then better use a desktop based SSL-Inspection proxy (e.g. Fiddler2), to connect the iRule Editor to your F5.

 

Cheers, Kai