Can't add ECDHE cipher in version 11.3.0

Question

Hi all,&nbsp;
I'm trying to add PFS support but when trying to follow the document "https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171.html?sr=36739985" and add the command "tmsh create /ltm profile client-ssl  ciphers DEFAULT:ECDHE:ECDHE_ECDSA:DHE_" I get the following error: invalid keyword.&nbsp;
In addition, when adding only "DEFAULT:ECDHE" and checking using the command "tmm --clientciphers ECDHE" i get nothing: &nbsp;
[admin@lb01:Active:Changes Pending] ~  tmm --clientciphers ECDHE
     ID SUITE                          BITS  PROT  METHOD CIPHER MAC    KEYX&nbsp;
Can you please assist? &nbsp;
Thanks 
Eli&nbsp;

hannes_rapp · Answer

ECDHE is unavailable in v11.3. At least v11.4 is required for any ECDHE cipher suites.&nbsp;

eli1234_26783 · Answer

Thank you!
That's weird the document clearly specifies 11.0.0 through 11.4.1.&nbsp;

brad_parker · Answer

Here is the list of ciphers in each version. https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html . The document you are referring to does not say ECDHE is supported in 11.0.0 through 1.4.1. EDH is, but that is not ECDHE. EDH is ephemeral Diffie-Hellman using RSA keys vs ECDHE is ephemeral Diffie-Hellman using EC(eliptical curve) keys.

kevin_stewart · Answer

This is a better reference: https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html&nbsp;
ECHDE support doesn't come until 11.4.0&nbsp;

eli1234_26783 · Answer

Thanks guys :)&nbsp;

Forum Discussion

Can't add ECDHE cipher in version 11.3.0

5 Replies

Recent Discussions

ASM instance creation

[ASM] - what is "Browser Challange file" ?

[ASM] - HTML5 Cross-Domain Request Enforcement - CLI command

Reverse Proxy Not Behaving

Stable Firmware for F5

Related Content

Cipher Suites Supported (12.1.5.3)

TMOS script for updating SSL profile cipher group and TLS versions

Cipher Suite Practices and Pitfalls

LTM Cipher rule

Disabling Weak Ciphers