Client SSL profile fall back

[Edouard]

Hi Guys,

We have some clients that use TLS1.0 whereas others use TLS1.2.

Could clientssl_tls1  profile be used for clients that use TLS1.0 and clientssl_tls1.2 be used for clients that work with TLS1.2.

All clients use the same server name (SNI) and clientssl_tls1 & clientssl_tls1.2 profiles are within the same VS.

Please advise.

Edouard.

[Mayur_Sutare]

Hi @Edouard ,

So basically, you need your vServer to accept requests on both TLS1.0 as well as TLS1.2 if I understood it correctly.

If that's so, then you can keep TLS1.0 as well as TLS1.2 enabled under associated client ssl profile. So single client-ssl profile will accept both requests and it will negotiate client on best possible match.

Additionally, if it is possible, try to keep all your vServers running on min TLS1.2 as lower SSL/TLS versions are prone to different vulnerabilties. You may be already knowing this but just thought of highlighting this also. Ty!

Hope it helps!

Mayur