TLS version 1.0 on Client side and TLS version 1.2 on Server side

Question

Hi All, &nbsp;I'm hoping you can help me with configuration of ssl profiles on the LTM. &nbsp;We have a legacy java application that can only establish TLS 1.0 outbound connections, but the server it's trying to establish connections to will only accept a minimum of TLS 1.2.&nbsp;We don't need to decrypt the traffic, just to enforce TLS 1.2 on the server side. &nbsp;How would you configure the clientssl/serverssl profiles for this?&nbsp;Many thanks for your help!

mayur_sutare · Answer

As client side SSL and Server side SSL works independently for maintaining SSL session between client & F5 and between F5 and backend server respectively, so your requirement should work.

To configure SSL profiles, you need to disable and/or enable required TLS version under client and server ssl profiles under advance tab--> ciphers options list. here by selecting Cipher group and enable desired TLS versions under options list. If you are selecting Cipher Suits option, then you can define specific cipher suits under the provided field. e.g. DEFAULT:!TLSv1:!TLSv1_1 This is example of cipher suits for your reference. This given cipher suit will block TLS1.0 and TLS1.1 versions. You can even apply specific encryption, key parameters under cipher suit along with keyword used for blocking TLS versions.

Hope it helps!

Mayur Sutare

sj · Answer

Just to add we are on BIG-IP version 15. We don't have SSL Orchestrator or SSL Forward Proxy license.

sj · Answer

Hi Mayur, &nbsp;Thanks very much for your response!&nbsp;I followed your advice and on the serverssl profile I blocked TLS v1/1.1 with DEFAULT:!TLSv1:!TLSv1_1:!ECDHE_ECDSA , I added the exclude for ECDHE just to test if this was working. &nbsp;I verified what ciphers this would include first:&nbsp;[xxxxxxbigip] log # tmm --serverciphers 'DEFAULT:!TLSv1:!TLSv1_1:!ECDHE_ECDSA'&nbsp;&nbsp;&nbsp;&nbsp;ID&nbsp;SUITE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BITS PROT&nbsp;&nbsp;CIPHER&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MAC&nbsp;&nbsp;&nbsp;KEYX&nbsp;0: 49199&nbsp;ECDHE-RSA-AES128-GCM-SHA256&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;ECDHE_RSA&nbsp;1: 49171&nbsp;ECDHE-RSA-AES128-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;2: 49191&nbsp;ECDHE-RSA-AES128-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;ECDHE_RSA&nbsp;3: 49200&nbsp;ECDHE-RSA-AES256-GCM-SHA384&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA384&nbsp;ECDHE_RSA&nbsp;4: 49172&nbsp;ECDHE-RSA-AES256-CBC-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;ECDHE_RSA&nbsp;5: 49192&nbsp;ECDHE-RSA-AES256-SHA384&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA384&nbsp;ECDHE_RSA&nbsp;6:&nbsp;&nbsp;156&nbsp;AES128-GCM-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;RSA&nbsp;7:&nbsp;&nbsp;47&nbsp;AES128-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;RSA&nbsp;8:&nbsp;&nbsp;47&nbsp;AES128-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;DTLS1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;RSA&nbsp;9:&nbsp;&nbsp;60&nbsp;AES128-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;RSA10:&nbsp;&nbsp;157&nbsp;AES256-GCM-SHA384&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA384&nbsp;RSA11:&nbsp;&nbsp;53&nbsp;AES256-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;RSA12:&nbsp;&nbsp;53&nbsp;AES256-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;DTLS1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;RSA13:&nbsp;&nbsp;61&nbsp;AES256-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;RSA14:&nbsp;&nbsp;65&nbsp;CAMELLIA128-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;CAMELLIA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;RSA15:&nbsp;&nbsp;132&nbsp;CAMELLIA256-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;CAMELLIA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;RSA16:&nbsp;&nbsp;158&nbsp;DHE-RSA-AES128-GCM-SHA256&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;EDH/RSA17:&nbsp;&nbsp;51&nbsp;DHE-RSA-AES128-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;EDH/RSA18:&nbsp;&nbsp;51&nbsp;DHE-RSA-AES128-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;DTLS1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;EDH/RSA19:&nbsp;&nbsp;103&nbsp;DHE-RSA-AES128-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;EDH/RSA20:&nbsp;&nbsp;159&nbsp;DHE-RSA-AES256-GCM-SHA384&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA384&nbsp;EDH/RSA21:&nbsp;&nbsp;57&nbsp;DHE-RSA-AES256-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;EDH/RSA22:&nbsp;&nbsp;57&nbsp;DHE-RSA-AES256-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;DTLS1&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;EDH/RSA23:&nbsp;&nbsp;107&nbsp;DHE-RSA-AES256-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;AES&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA256&nbsp;EDH/RSA24:&nbsp;&nbsp;69&nbsp;DHE-RSA-CAMELLIA128-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.2&nbsp;CAMELLIA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;EDH/RSA25:&nbsp;&nbsp;136&nbsp;DHE-RSA-CAMELLIA256-SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.2&nbsp;CAMELLIA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHA&nbsp;&nbsp;&nbsp;EDH/RSA26:&nbsp;4865&nbsp;TLS13-AES128-GCM-SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;128&nbsp;TLS1.3&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL&nbsp;&nbsp;*27:&nbsp;4866&nbsp;TLS13-AES256-GCM-SHA384&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;256&nbsp;TLS1.3&nbsp;AES-GCM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL&nbsp;&nbsp;*&nbsp;&nbsp;&nbsp;Then I've just done SSLDump and I see the following:&nbsp;New TCP connection #1: x.x.x.x(50884) &lt;-&gt; x.x.x.x(443)1 1&nbsp;0.0023 (0.0023)&nbsp;C&gt;SV3.3(199)&nbsp;Handshake&nbsp;&nbsp;&nbsp;ClientHello&nbsp;&nbsp;&nbsp;&nbsp;Version 3.3&nbsp;&nbsp;&nbsp;&nbsp;random[32]=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;5f 34 07 21 bb 19 13 72 4d bf 49 3f de e5 13 80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dc 25 6e 09 85 2a ee 2f 68 73 96 1f 2f e4 c6 8e&nbsp;&nbsp;&nbsp;&nbsp;cipher suites&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.............output ommitted.................&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_AES_128_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;compression methods&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL&nbsp;&nbsp;&nbsp;&nbsp;extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server_name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;status_request&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;supported_groups&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ec_point_formats&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;signature_algorithms&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;signature_algorithms[18]=xxxxxxxxxxxx*output omitted************&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SessionTicket&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;application_layer_protocol_negotiation&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;extended_master_secret&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Unknown extension (0x18)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;renegotiation_info1 2&nbsp;0.0032 (0.0009)&nbsp;S&gt;CV3.3(91)&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerHello&nbsp;&nbsp;&nbsp;&nbsp;Version 3.3&nbsp;&nbsp;&nbsp;&nbsp;random[32]=xxxxxxxxxxxx*output omitted************&nbsp;&nbsp;&nbsp;&nbsp;session_id[32]=xxxxxxxxxxxx*output omitted************&nbsp;&nbsp;&nbsp;&nbsp;cipherSuite&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256&nbsp;&nbsp;&nbsp;&nbsp;compressionMethod&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL&nbsp;&nbsp;&nbsp;&nbsp;extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;renegotiation_info&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ec_point_formats&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;extended_master_secret1 3&nbsp;0.0032 (0.0000)&nbsp;S&gt;CV3.3(956)&nbsp;Handshake&nbsp;&nbsp;&nbsp;Certificate1 4&nbsp;0.0032 (0.0000)&nbsp;S&gt;CV3.3(333)&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerKeyExchange&nbsp;&nbsp;&nbsp;&nbsp;ServerKeyExchange[329]=xxxxxxxxxxxx*output omitted************1 5&nbsp;0.0032 (0.0000)&nbsp;S&gt;CV3.3(4)&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerHelloDone1&nbsp;&nbsp;0.0246 (0.0214)&nbsp;C&gt;S&nbsp;TCP FIN1&nbsp;&nbsp;0.0247 (0.0000)&nbsp;S&gt;C&nbsp;TCP FIN&nbsp;Even though it's negotiating the right version (3.3) which I believe is TLS 1.2, according to my cipher list it shouldn't offer up ECDHE_ECDSA, which it does in the client hello. Then after the server hello there is just a TCP FIN from the client, so the handshake never completes.&nbsp;I'll post a picture of the profile config

sj · Answer

This is the serverssl profile config - on the ciphers section

sj · Answer

On the clientssl profile, I've allowed a cipher suit of DEFAULT as this side can be TLS1 (from client to BIG-IP)&nbsp;

Forum Discussion

TLS version 1.0 on Client side and TLS version 1.2 on Server side

5 Replies

Recent Discussions

F5Access | MacOS Sonoma

Rewrite uri translation not working

Chrome V 124+ on MacOS - Virtual Server Access Issue

Transaction looks successful but file not downloading

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Related Content

TMOS Version Update Paths

Big IP version 12 API

F5OS Tenants TMOS version upgrade

BIGdiff Version 2

gtm sync group different software version