This message was deleted.
# citrix-netscalers
Slackbot
03/19/2020, 9:11 PMThis message was deleted.
j
Jonathan Pitre
03/19/2020, 9:11 PMHere's my ssl profile settings
Jonathan Pitre
03/19/2020, 9:15 PMI'm also trying to get the Key Exchange from 90% to 100%. I read on this blog https://nsroot.blog/2020/02/21/scoring-an-a-on-ssllabs-with-tls1-2-and-tls1-3/ that it was caused by bad elliptic curves settings.
I took out P_223 and P_256 but I still can't reach 100%. This is driving me crazy lol
m
Mads Petersen
03/19/2020, 9:44 PMIf you want to get higher key exchange strength, then you need to remove the DH key and use ECDHE ciphers only (You can add the TLS1.3 also)
But you will break windows 2012 R2 (windows 8.1) if you go all out with the ciphers
j
Jonathan Pitre
03/20/2020, 4:37 AMwhat do you mean by "break windows 2012 R2/8.1" ?
Jonathan Pitre
03/20/2020, 4:48 AMStill can't get key exchange strength to 100% with these ciphers configured.
Jonathan Pitre
03/20/2020, 4:48 AMStill can't get key exchange strength to 100% with these ciphers configured.
l
Leee Jeffries
03/22/2020, 2:58 PMMads means that essentially older clients will not be able to connect as they dont support the later protocols and cipher suites. Can you give us some background on why you want to secure it that much?
m
Mads Petersen
03/22/2020, 5:12 PMHi @Jonathan Pitre, like @Leee Jeffries said i mean that you might end up breaking access for clients that you want to connect.
Can you DM me the url, so i can see a full report of it?
5 Views