Forum Discussion

dw_888_212625's avatar
dw_888_212625
Icon for Nimbostratus rankNimbostratus
Feb 02, 2016

how to disable all weak ciphers and tlsv1 in ltm11.5.3 globally

it is not advisable to modify the default ssl profile, however if we would really need to disable all weak ciphers and tlsv1 protocol globally for all virtual servers, please advise beside creating a...
LTM
security
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous

The default cipher suite in 11.5.3 is already sufficient to comply with current PCI DSS 3.0 requirements. Leaving the paranoid security-guru suggestions aside, there's nothing wrong with using the DEFAULT of 11.5.3 today.

Config related:

Your only sensible option for applying a new global configuration is to create a new clientside SSL profile (i.e. clientssl_custom) which you will then re-use as the 

Parent Profile
when creating you custom clientssl profiles.