SSL profile infrastructure 编辑

Vulnerabilities in SSLv3 and RC4 implementation have emphasized the need to use the latest ciphers and protocols to negotiate the security settings for a network connection. Implementing any changes to the configuration, such as disabling SSLv3 across thousands of SSL end points, is a cumbersome process. Therefore, settings that were part of the SSL end points configuration have been moved to the SSL profiles, along with the default ciphers. To implement changes in the configuration, including cipher support, you need only modify the profile that is bound to the entities.

The default front-end and default back-end SSL profiles contain all the default ciphers and ECC curves, in addition to the settings that were part of the old profiles. Sample outputs for the default profiles are provided in the appendix. The Enable Default Profile operation automatically binds the default front-end profile to all front-end entities, and the default back-end profile to all back-end entities. You can modify a default profile to suit your deployment. You can also create custom profiles and bind them to SSL entities.

The front-end profile contains parameters applicable to a front-end entity. That is, they apply to the entity that receives requests from a client. Typically, this entity is an SSL virtual server or transparent SSL service on the Citrix ADC appliance. The back-end profile contains parameters applicable to a back-end entity. That is, they apply to the entity on the ADC appliance that sends client requests to a back-end server. Typically, this entity is an SSL service on the Citrix ADC appliance. If you try to configure an unsupported parameter, the error ERROR: Specified parameters are not applicable for this type of SSL profile appears.

Important:

• An SSL profile takes precedence over SSL parameters. That is, if you configure SSL parameters using the set ssl parameter command, and later bind a profile to an SSL entity, the settings in the profile take precedence.

• After the upgrade, if you enable the default profiles, you cannot undo the changes. That is, the profiles cannot be disabled. Save the configuration and create a copy of the configuration file (ns.conf) before enabling the profiles. However, if you do not want to use the features in the default profile, you can continue to use the old SSL profiles. For more information about these profiles, see Legacy SSL profile.

• From release 11.1 51.x, in the GUI and CLI, a confirmation prompt is added when you enable the default profile to prevent enabling it by mistake.

From release 13.1 build 17.x, protocols lower than TLSv1.2 are disabled on the SSL internal services.

• If the default profile is enabled, ns_default_ssl_profile_internal_frontend_service is bound to the SSL internal services and SSLv3, TLSv1.0, and TLSv1.1 protocols are disabled in this profile.
• If the default profile is not enabled, SSLv3, TLSv1.0, and TLSv1.1 protocols are disabled in the SSL internal services parameters.

Command:

set ssl parameter -defaultProfile ENABLED
    Save your configuration before enabling the Default profile. You cannot undo the changes. Are you sure you want to enable the Default profile? [Y/N]Y
Done
<!--NeedCopy-->