Smarter by Design.Simpler for Business
lb ssl-security
The lb ssl-security command creates the SSL security profiles that determine which versions, cipher algorithms and verification rules will be valid in the TLS connections of a vService. Its panel equivalent is the TLS Security Profiles screen.
Command Summary
# Tab after the command
admin@TR7LBWAF01> lb ssl-security
add delete list show update
admin@TR7LBWAF01> lb ssl-security list # list all of them
admin@TR7LBWAF01> lb ssl-security show <id> # show one
admin@TR7LBWAF01> lb ssl-security add name <name> … # new profile
admin@TR7LBWAF01> lb ssl-security update id <id> … # change
admin@TR7LBWAF01> lb ssl-security delete <id> # delete
admin@TR7LBWAF01>
Required Fields
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | name | Required | The name of the profile; it must be unique in the collection |
All the remaining fields are optional; the ones that are not given are applied with their default values.
The Version and Cipher Fields
| Field | What it does | What is written after it |
|---|---|---|
--minSslVersion | Determines the lowest TLS version that will be accepted | A version value (default TLSv1.1); Tab lists them |
--maxSslVersion | Determines the highest TLS version that will be accepted | A version value (default TLSv1.3) |
--cipherAlgorithm | Selects the cipher algorithm set | hardware (default) · onlySecure · tls13 · old · general · strictSecure · strictOld · manual |
--manualCipherAlgorithmList.N | Selects the algorithms one by one | An algorithm name; each with its own index. It opens only when --cipherAlgorithm manual is selected |
--curves.N | Selects the curves to be used in the key exchange | X25519 · X448 (both are valid only in TLS 1.3) |
--pqc | Turns on the post-quantum key exchange | true · false (default false) |
The Connection Behavior
| Field | What it does | What is written after it |
|---|---|---|
--noTlsTickets | Makes the undefined TLS requests be restarted; the session tickets are not used | true · false (default false) |
--useQat | Turns on the SSL operations being done with the hardware accelerator | true · false (default false) |
--sniHostValidation | Makes the SNI sent by the client and the Host header match compulsory | true · false (default false) |
--ocspStapling | Turns on the revocation status of the certificate being attached by the server | true · false (default false) |
The Client Certificate Verification
This group manages the verification of the certificate of the visitor on the listening side. All the fields open when --clientCertAuth true is written.
| Field | Status | What it does | What is written after it |
|---|---|---|---|
--clientCertAuth | Optional | Turns on the client certificate verification | true · false (default false) |
--clientCertVerifyType | Conditional | Determines whether the certificate is required or optional | required the connection is not accepted without a certificate (default) · optional if there is a certificate, it is verified |
--caFiles.N | Conditional | Selects the CAs that will be trusted in the verification | The lb ca records; each with its own index |
--caErrorStrategy | Conditional | Selects what will be done on the verification errors | denyAll rejects on every error (default) · ignoreAll ignores the errors · manualIgnoreList ignores only the selected errors |
--caErrorsToIgnore.N | Conditional | Selects the verification errors that will be ignored | An error code; it opens only when --caErrorStrategy manualIgnoreList is selected |
Some of the error codes that can be ignored: 2 the parent certificate could not be fetched · 3 the certificate revocation list could not be fetched · 7 the certificate signature is wrong · 19 a self-signed certificate in the chain · 24 an invalid CA certificate · 31 the authority and issuer serial numbers do not match. The whole list is seen with Tab.
Ignoring the errors weakens the verification
When --caErrorStrategy ignoreAll is selected, the connection is accepted even if the certificate chain is wrong. It is used only if it is known which error is ignored for which reason; for a specific error manualIgnoreList is safer.
The HSTS Fields
| Field | Status | What it does | What is written after it |
|---|---|---|---|
--hsts | Optional | Turns on the sending of the header that tells the browser to connect to the site only with HTTPS | true · false (default false) |
--hstsMaxAge.val · --hstsMaxAge.unit | Optional | Determines how long this rule will stay valid in the browser | A number and a unit (default 180 days) |
--hstsIncludeSubdomains | Conditional | Makes the rule cover the subdomains as well | true · false (default false); it opens only while --hsts true |
--hstsPreload | Conditional | Adds the browser preload list mark to the header | true · false (default false); it opens only while --hsts true |
Examples
admin@TR7LBWAF01> lb ssl-security add name strict-profile \
--minSslVersion TLSv1.2 --maxSslVersion TLSv1.3 --cipherAlgorithm onlySecure \
--hsts true --hstsMaxAge.val 365 --hstsMaxAge.unit d --hstsIncludeSubdomains true
admin@TR7LBWAF01>
admin@TR7LBWAF01> lb ssl-security add name mtls-profile \
--clientCertAuth true --clientCertVerifyType required \
--caFiles.0 <ca> --caErrorStrategy manualIgnoreList --caErrorsToIgnore.0 19
admin@TR7LBWAF01>
admin@TR7LBWAF01> lb ssl-security add name manual-cipher --cipherAlgorithm manual \
--manualCipherAlgorithmList.0 <algorithm> --manualCipherAlgorithmList.1 <algorithm> \
--curves.0 X25519 --pqc true
admin@TR7LBWAF01> lb service update id <vService> --sslSecurity <profile>
admin@TR7LBWAF01>
Updating and Deleting
admin@TR7LBWAF01> lb ssl-security update id <id> --minSslVersion TLSv1.3
# removing a single CA · emptying the list fields
admin@TR7LBWAF01> lb ssl-security update id <id> --caFiles.0.delete
admin@TR7LBWAF01> lb ssl-security update id <id> --curves.delete
admin@TR7LBWAF01> lb ssl-security delete <id>
admin@TR7LBWAF01>
Things to Know
- A profile does not work on its own. The settings are applied when the profile is bound to a vService with the
--sslSecurityfield. - In the backend connection a part of the profile is valid. The same profile can also be selected in the
lb backendrecord with--sslSecurityProfile; in that connection only the minimum and the maximum SSL version, the cipher list and the curve settings are applied. - The client certificate verification is on the listening side. This group verifies the certificate of the visitor; TR7 identifying itself to the backend is the
--sslClientCertfield in the backend record. - The curves are valid only in TLS 1.3. The
X25519andX448selections are not effective in the older versions. - HSTS is hard to undo. The browser carries on connecting to the site only with HTTPS until the time expires; before extending the time, it should be made sure that the certificate is renewed without interruption.
