Forum Discussion

Martin182's avatar
Icon for Nimbostratus rankNimbostratus
Sep 12, 2023

Cipher Suites Supported (

Hi, I am trying to adjust the SSL profile of a service to get grade A in SSL Labs.
The machine the virtual server runs on is:
Main Package
Product BIG-IP
Build 0.16.5
Edition Engineering Hotfix
Date Tue Mar 9 12:02:22 PST 2021

Hotfix List

The problem is that I can't find the F5 resource where to see the cipher suites supported by this version.
If you look at this url, only 12.1.3 appears:

- SSL Labs test:

"This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B."


Any help will be welcome

Thank you very much, best regards


7 Replies

  • Hi Martin182,

    No new cipher suites have been added for versions 12.1.4 and 12.1.5.

    You can view all ciphers with the following command from cli.

    tmm --clientciphers all

    You can use the "!DHE:!DH" string to remove DHE and DH key exchange parameters from the cipher suite. Or you can use only "ECDHE+AES-GCM" cipher suite.

    • Martin182's avatar
      Icon for Nimbostratus rankNimbostratus

      Hi Enes, first of all thank you for your reply 🙂
      You mean to enter as string in the ciphers field only ECDHE+AES-GCM right ?

      My current string is:

      But I don't know why only 6 of them appear in the SSL Labs test and not all 8.

      • Hi,

        When you enter "ECDHE+AES-GCM", the following cipher suites match:


        You cannot view cipher suites containing ECDSA ciphers on ssllabs. Because the signature algorithm of the SSL Certificate is RSA.


        K10340213: ECDSA ciphers not being shown at SSLabs test

  • Just check your ssl config, there is a cyhper config hidden under a Basic/advanced filter in the profile that might not be fully locked down.

    I had something very simular. in v14. and it was more on the ssl config than what was supported.

    • Martin182's avatar
      Icon for Nimbostratus rankNimbostratus

      You mean the cipher rules/groups?, they are not available on this version, I think the first one to implement them is v13.

      • O, sorry i started my f5 works at late v13 straight into v14 about 2 months later.
        So it looks like its a feature that's appeared in that time!