Applies To:Show Versions
BIG-IP Link Controller
Create a custom Client SSL profile
On the Main tab, click
. The Client SSL profile list screen opens.
The New Client SSL Profile screen opens.
- In the Name field, type a unique name for the profile.
- From the Parent Profile list, select clientssl.
Select the Custom check box.
The settings become available for change.
- From the Configuration list, select Advanced.
- For the Mode setting, select the Enabled check box.
For the Certificate Key Chain
setting, click Add.
From the Certificate list,
select a certificate name.
This is the name of a certificate that you installed on the BIG-IP system. If you have not generated a certificate request nor installed a certificate on the BIG-IP system, and the BIG-IP system is not part of a device service clustering (DSC) configuration, you can specify the name of the existing certificate named default.Important: If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default certificate name, and ensure that this same certificate name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.
From the Key list, select the
name of the key associated with the certificate specified in the
This is the name of a key that you installed on the BIG-IP system. If you have not installed a key on the BIG-IP system, and the BIG-IP system is not part of a device service clustering (DSC) configuration, you can specify the name of the existing key named default.Important: If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default key name, and ensure that this same key name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.
From the Chain list, select
the chain that you want to include in the certificate key chain.
A certificate chain can contain either a series of public key certificates in Privacy Enhanced Mail (PEM) format or a series of one or more PEM files. A certificate chain can contain certificates for Intermediate certificate Authorities (CAs).Note: The default self-signed certificate and the default CA bundle certificate are not appropriate for use as a certificate chain.
For the Passphrase field,
type a string that enables access to SSL certificate/key pairs that are
stored on the BIG-IP system with password protection.
This setting is optional. For added security, the BIG-IP system automatically encrypts the pass phrase itself. This pass phrase encryption process is invisible to BIG-IP system administrative users.
- Click Add.
- From the Certificate list, select a certificate name.
In the Certificate Key Chain
setting, click Add
again, and repeat the process for all certificate key chains that you want to
At a minimum, you must specify an RSA certificate key chain.The result is that all specified key chains appear in the text box.
To enable OCSP stapling, select theOCSP Stapling check
To enable OCSP stapling, you must first create an OCSP Stapling profile. See Creating an OCSP stapling profile for detailed steps.
- If you want to Notify Certificate Status to Virtual Server, select the check box.
For the Ciphers setting, specify a
cipher group or cipher string by choosing one of these options.
Note: If you specified an ECDSA certificate key chain in the Certificate Key Chain setting, you must include the cipher string ECDHE_ECDSA in the cipher group or cipher string that you specify in the Ciphers setting. (At a minimum, you should specify a cipher group or string such as DEFAULT:ECDHE_ECDSA.) This is necessary to ensure successful cipher negotiation when the BIG-IP system is offered an ECDSA-based certificate only.
Option Description Cipher Group
Select an existing cipher group from the list when you want to use a system-defined or custom cipher group to define the ciphers that the BIG-IP system uses for negotiating SSL connections. Here's an example of the Ciphers setting where we've selected a custom cipher group that we created earlier.
Type a cipher string in the box if you want to manually specify a cipher string instead of selecting a cipher group. For security and performance reasons, consider following these recommendations:
- Always append ciphers to the DEFAULT cipher string.
- Type a cipher string that includes the ECC key type, because its shorter length speeds up encryption and decryption while still offering virtually the same level of security.
- Disable ADH ciphers but also include the keyword HIGH. To do this, just include both !ADH and :HIGH in your cipher string.
- For AES, DES, and RC4 encryption types, make sure you specify the DHE key exchange method. DHE uses Forward Privacy, which creates a key that it throws away after each session so that the same session key never gets used twice. When you use DHE, make sure that the SSL private key isn't being shared with a monitoring system or a security device like an intrusion detection or prevention system. Also, diagnostic tools like ssldump won't work when you're using Forward Secrecy.
- Disable EXPORT ciphers by including !EXPORT in the cipher string.
- If you can live with removing support for the SSLv3 protocol version, do it. This protocol version is not secure. Simply include :!SSLv3 in any cipher string you type.
Here's an example of the Ciphers setting where we have opted to manually type the cipher string DEFAULT:ECDHE-RSA-AES-128-GCM-SHA256:!ADH:!EXPORT:HIGH:
- Configure any other settings as needed.
- Click Finished.