Hello All, We are running BIG-IP 22.214.171.124 Build 0.0.2 Point Release 1 and attempting to configure an SSL client profile to only negotiate TLS 1.3, https://support.f5.com/csp/article/K10251520 We've configured a Cipher group to only allow TLS13-AES128-GCM-SHA256 and TLS13-AES256-GCM-SHA384. However, this breaks things. Packet captures reveal when our client hits the VIP (Chrome v70), it tries to negotiate TLSv1.2. How do we get the browser to send the initial SSL "Client Hello" request using the TLSv1.3 protocol? Right now its sending TLSv1.2 Client Hello's and VIP just responds with handshake failure. Is this a browser version setting thing or an SSL Client profile issue? Thanks All!
Did you go to chrome://flags in the Chrome browser and enable TLS 1.3? In any case, Chrome only ever supported drafts 23 and 28 (and now the final), while BIG-IP 14.0 supports draft 26.
RFC 8446 TLS 1.3 support comes in the 14.1.
But you're on the right configuration path:
• Create a cipher rule (Local Traffic - Ciphers - Rules)
○ Cipher Suites: 'TLSv1_3'
○ Note that the above (on 14.0) only supports TLS13-AES128-GCM-SHA256 and TLS13-AES256-GCM-SHA384
○ Note that the 14.0 'DEFAULT' stack also includes the two TLS 1.3 ciphers
• Create a cipher group (Local Traffic - Ciphers - Groups)
○ Select TLS 1.3 cipher rule
• Create a client SSL profile
○ Ciphers: cipher group
○ Options List: disable 'No TLSv1.3' option
I asked several F5 employees about TLS 1.3 support during this year's Agility conference in August.
They all gave me the same answer.
The final RFC standard for TLS 1.3 would be included for client facing connections in version 14.1 expected to be released late 1st quarter/early 2nd quarter.
Has that changed?
Client-side TLS 1.3 comes in 14.1.
Server-side TLS 1.3 comes in 15.0.
Thanks for the quick response!
Any updates on the expected release date for 14.1?
Version 14.1 was released last week.
Can anybody confirm it this version includes the final standard version of TLS 1.3 on the Client-side?
Haven't seen anything about it on the release notes.