JD1
Dec 13, 2017Altostratus
TMUI / Configuration WebUI - TLS/SSL Configuration - ECDHE
Hi All,
I'm currently using BIG-IP 11.6.2 HF1.
I'm required to secure the Management WebUI ciphers offered out.
I'd prefer to drop all key exchange methods except for ECDHE.
However, it seems
modify sys httpd ssl-ciphersuite
doesn't seem to acknowledge the existence of ECDHE.
openssl ciphers -v
identifies the presence, which I believe sys httpd ssl-ciphersuite
utilises instead of tmm's cipher suites (since the sys httpd process runs outside of tmm), so I'd expect Apache HTTPd's mod_ssl would be leveraging this.
So my question is, in three parts:
- Why doesn't
recognise ECDHE?sys httpd ssl-ciphersuite
- Is there anyway to utilize ECDHE on
on 11.6.2 HF1?sys httpd
- Does 12.x support this?
Many thanks,
JD
But the point being is that the command sys httpd ssl-ciphersuite on 11.6.x, doesn't seem to then correctly configure Apache services to use this for the TMUI.
i understand this has been corrected in 12.0.