World of EUC

Don't enable it for everyone at once. While it's not likely to break anything, I never hit the big shiny switch unless there's no other option. Easy way to clone an existing SSL profile is to check the box next to it before hitting "add", then when the New Profile screen opens up it should already have those options selected and you can just flip the bit for TLS 1.3.

TLS1.3 is not taking advantage of the SSL hardware cards, maybe on latest ADC models but not all.

You are correct.

<https://docs.citrix.com/en-us/citrix-adc/13/ssl/ciphers-available-on-the-citrix-adc-appliances>

"Crypto operations on TLS 1.3 are not offloaded to crypto acceleration chips. All computation for TLS 1.3 handshakes is done in software on all supported platforms, even if Coleto or Cavium acceleration chips are present."

This is not good. Do you know if this will be supported in a future release, <@ULPS6HFAT>?

oh man you're gonna make me bust out the legal disclaimer

Can't speak on behalf of roadmap/etc, only PM can do that. You can certainly get more info on plans by reaching out to your SE though.

For those who are interested:

I have started enabling TLS 1.3 on a few VIPs and in regards to connections the split is 60/40 in favour of TLS 1.2.

<@ULPS6HFAT>Am I right in thinking TLS 1.3 with ESNI will break multiple applications/certs on a single VIP?

Haven't gone too in depth on it yet, but I would expect it to break without some significant trickery.