Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

LTM SSL Client Profile for TLS 1.3

Hello All, We are running BIG-IP 14.0.0.1 Build 0.0.2 Point Release 1 and attempting to configure an SSL client profile to only negotiate TLS 1.3, https://support.f5.com/csp/article/K10251520 We've configured a Cipher group to only allow TLS13-AES128-GCM-SHA256 and TLS13-AES256-GCM-SHA384. However, this breaks things. Packet captures reveal when our client hits the VIP (Chrome v70), it tries to negotiate TLSv1.2. How do we get the browser to send the initial SSL "Client Hello" request using the TLSv1.3 protocol? Right now its sending TLSv1.2 Client Hello's and VIP just responds with handshake failure. Is this a browser version setting thing or an SSL Client profile issue? Thanks All!

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Did you go to chrome://flags in the Chrome browser and enable TLS 1.3? In any case, Chrome only ever supported drafts 23 and 28 (and now the final), while BIG-IP 14.0 supports draft 26.

RFC 8446 TLS 1.3 support comes in the 14.1.

But you're on the right configuration path:

• Create a cipher rule (Local Traffic - Ciphers - Rules)
    ○ Cipher Suites: 'TLSv1_3'
    ○ Note that the above (on 14.0) only supports TLS13-AES128-GCM-SHA256 and TLS13-AES256-GCM-SHA384
    ○ Note that the 14.0 'DEFAULT' stack also includes the two TLS 1.3 ciphers

• Create a cipher group (Local Traffic - Ciphers - Groups)
    ○ Select TLS 1.3 cipher rule

• Create a client SSL profile
    ○ Ciphers: cipher group
    ○ Options List: disable 'No TLSv1.3' option
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

I asked several F5 employees about TLS 1.3 support during this year's Agility conference in August.

They all gave me the same answer.

The final RFC standard for TLS 1.3 would be included for client facing connections in version 14.1 expected to be released late 1st quarter/early 2nd quarter.

Has that changed?

0
Comments on this Answer
Comment made 1 month ago by Kevin Stewart

Client-side TLS 1.3 comes in 14.1.

Server-side TLS 1.3 comes in 15.0.

0
Comment made 1 month ago by wlopez 306

Thanks for the quick response! Any updates on the expected release date for 14.1?

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Version 14.1 was released last week.

Can anybody confirm it this version includes the final standard version of TLS 1.3 on the Client-side?

Haven't seen anything about it on the release notes.

0