# About Cipher Suites

**URL:** <https://community.f5.com/t/about-cipher-suites/76079>\
**Category:** Technical Forums\
**Tags:** application-delivery\
**Created:** [May 8, 2025, 3:20am UTC](https://community.f5.com/t/about-cipher-suites/76079 "2025-05-08T03:20:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SanYang](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@SanYang](https://community.f5.com/u/SanYang)\
**Post date:** [May 8, 2025, 3:20am UTC](https://community.f5.com/t/about-cipher-suites/76079/1 "2025-05-08T03:20:03Z")

</div>

Hello experts,

We’ve been doing SSL LAB scans lately.  
We found that with the same certificate and the same client ssl profile settings, the scanning results are not the same.

 ![image_341190.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/d/dc47bc2bc82da4515fb69aec990ead21845da269.png)

The strange thing is that according to the following article

> **[myF5](https://my.f5.com/manage/s/article/K12982)**

What I see is that F5 is not yet supported by secp521r1.

Why does the scanned result have secp521r1?

---

<div class="post-metadata">

**Author:** ![Tofunmi](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/tofunmi/32/17606_2.png) [@Tofunmi](https://community.f5.com/u/Tofunmi)\
**Post date:** [May 12, 2025, 1:19pm UTC](https://community.f5.com/t/about-cipher-suites/76079/2 "2025-05-12T13:19:52Z")

</div>

Are you doing SSL offloading on that VIP? If your VIP is not doing full SSL offload (e.g., SSL Passthrough or using a transparent profile), the curve seen could be coming from the backend server, not F5.

openssl s\_client -connect \<IP\>:443 -curves secp521r1

If the VIP is truly terminating SSL and does not support secp521r1, the handshake should fail. If the backend server supports it, the same test against it directly will succeed. This should help isolate whether the F5 or the backend is advertising support for that curve.