Forum Discussion
Fallout1984
Oct 01, 2021Cirrocumulus
Saidur,
Here is a suggestion for ciphers to make a cert more secure (ie. to get an "A+" when checked via ssllabs.com):
DEFAULT:!3DES:!DHE:!RC4:!RSA:@STRENGTH
And then for the options, disallow:
TLSv1, TLSv1.1, SSLv2 and SSLv3.
What the "@STRENGTH" option does is prioritize the stronger ciphers. You could add that at the end of your cipher list and that would help, but ideally you want to disallow the weaker ciphers.
You can look at the preferred cipher list and order that a setting will give you by logging into your F5 via the CLI and entering this command (using DEFAULT:!3DES:!DHE:!RC4:!RSA:@STRENGTH as an example):
tmm --clientciphers 'DEFAULT:!3DES:!DHE:!RC4:!RSA:@STRENGTH'
Hopefully, this helps.
Alan