Guys, anyone got a link to a good article for configuring Netscaler to score and A + on SSL labs for external facing vservers/gateways? Been a while since I done it, cheers

Nice one, John 🙂

I can see they still need to update their article. Here is mine TLS hardening for SNI and Non-SNI

add ssl cipher cg_secure_cipher

bind ssl cipher cg_secure_cipher -cipherName TLS1.3-CHACHA20-POLY1305-SHA256 -cipherPriority 1

bind ssl cipher cg_secure_cipher -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 -cipherPriority 2

bind ssl cipher cg_secure_cipher -cipherName TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384 -cipherPriority 3

bind ssl cipher cg_secure_cipher -cipherName TLS1.2-ECDHE-ECDSA-CHACHA20-POLY1305 -cipherPriority 4

bind ssl cipher cg_secure_cipher -cipherName TLS1.3-AES128-GCM-SHA256 -cipherPriority 5

bind ssl cipher cg_secure_cipher -cipherName TLS1.3-AES256-GCM-SHA384 -cipherPriority 6

add ssl profile ssl_prof_fe_secure_cipher_sni -sessReuse ENABLED -sessTimeout 120 -tls1 DISABLED -tls11 DISABLED -tls13 ENABLED -SNIEnable ENABLED -denySSLReneg FRONTEND_CLIENT -HSTS ENABLED -maxage 31536000 -IncludeSubdomains YES -preload YES

bind ssl profile ssl_prof_fe_secure_cipher_sni -eccCurveName P_384

bind ssl profile ssl_prof_fe_secure_cipher_sni -eccCurveName P_521

bind ssl profile ssl_prof_fe_secure_cipher_sni -cipherName cg_secure_cipher -cipherPriority 1

unbind ssl profile ssl_prof_fe_secure_cipher_sni -eccCurveName P_224

unbind ssl profile ssl_prof_fe_secure_cipher_sni -eccCurveName P_256

unbind ssl profile ssl_prof_fe_secure_cipher_sni -cipherName DEFAULT

add ssl profile ssl_prof_fe_secure_cipher_nosni -sessReuse ENABLED -sessTimeout 120 -tls1 DISABLED -tls11 DISABLED -tls13 ENABLED -denySSLReneg FRONTEND_CLIENT -HSTS ENABLED -maxage 31536000 -IncludeSubdomains YES -preload YES

bind ssl profile ssl_prof_fe_secure_cipher_nosni -eccCurveName P_384

bind ssl profile ssl_prof_fe_secure_cipher_nosni -eccCurveName P_521

bind ssl profile ssl_prof_fe_secure_cipher_nosni -cipherName cg_secure_cipher -cipherPriority 1

unbind ssl profile ssl_prof_fe_secure_cipher_nosni -eccCurveName P_224

unbind ssl profile ssl_prof_fe_secure_cipher_nosni -eccCurveName P_256

unbind ssl profile ssl_prof_fe_secure_cipher_nosni -cipherName DEFAULT

Nice one, sir 🙂

Else, if you want to automate it via Powershell, I used this updated script from @Marco Hofmann, recently 🙂 https://www.meinekleinefarm.net/scoring-an-a-at-ssllabs-com-with-citrix-netscaler-q2-2023-update/