F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Martin182's avatar
Martin182
Icon for Cirrus rankCirrus
Sep 12, 2023
Solved

Cipher Suites Supported (12.1.5.3)

Hi, I am trying to adjust the SSL profile of a service to get grade A in SSL Labs. The machine the virtual server runs on is: --- Sys::Version Main Package Product BIG-IP Version 12.1.5.3 Buil...
security
Enes_Afsin_Al's avatar
Enes_Afsin_Al
Icon for MVP rankMVP
Sep 12, 2023

Hi Martin182,

No new cipher suites have been added for versions 12.1.4 and 12.1.5.

https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote-bigip-12-1-4.html#asm_rn_new
https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote-bigip-12-1-5.html#rn_new

You can view all ciphers with the following command from cli.

tmm --clientciphers all

You can use the "!DHE:!DH" string to remove DHE and DH key exchange parameters from the cipher suite. Or you can use only "ECDHE+AES-GCM" cipher suite.

  • Martin182's avatar
    Martin182
    Icon for Cirrus rankCirrus
    Sep 12, 2023

    Hi Enes, first of all thank you for your reply 🙂
    You mean to enter as string in the ciphers field only ECDHE+AES-GCM right ?

    My current string is:
    ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256

    But I don't know why only 6 of them appear in the SSL Labs test and not all 8.

    • Enes_Afsin_Al's avatar
      Enes_Afsin_Al
      Icon for MVP rankMVP
      Sep 12, 2023

      Hi,

      When you enter "ECDHE+AES-GCM", the following cipher suites match:

      ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384

      You cannot view cipher suites containing ECDSA ciphers on ssllabs. Because the signature algorithm of the SSL Certificate is RSA.

      ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-GCM-SHA256

      K10340213: ECDSA ciphers not being shown at SSLabs test
      https://my.f5.com/manage/s/article/K10340213

      • Martin182's avatar
        Martin182
        Icon for Cirrus rankCirrus
        Sep 12, 2023

        Okay, thanks again.
        I need to think about which configuration to apply, the ECDHE+AES-GCM option leaving only 2 cipher suites might be too restrictive as it is a service accessed by a large number of clients.