Back to SSL Troubleshooting
F5 BIG-IPSSL LabsBest PracticesSecurity

Get an A+ on SSL Labs with F5 BIG-IP

Optimize your F5 SSL configuration for the best possible grade.

12 min readDecember 2025
Get an A+ on SSL Labs with F5 BIG-IP

The 30-Second Version

The quick path to A+:

  1. Remove TLS 1.0 and 1.1
  2. Use strong cipher string (see below)
  3. Complete certificate chain
  4. Enable HSTS (for A+, not just A)

Recommended cipher string:

ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!MD5:!DSS

Understanding SSL Labs Grades

How SSL Labs Scores Your Configuration

CategoryWhat It ChecksWeight
CertificateValid, trusted, correct chain30%
Protocol SupportTLS versions supported30%
Key ExchangeCipher strength, key size30%
Cipher StrengthCipher algorithms used10%

Grade Requirements

GradeRequirements
A+A grade + HSTS with long duration
ANo major issues, good configuration
BMinor issues (old protocols, weak ciphers)
CModerate issues
FMajor vulnerability or configuration error

Grade Caps (Things That Limit Your Grade)

IssueGrade Cap
Certificate not trustedT (Trust)
Certificate name mismatchT
TLS 1.0 enabledB
TLS 1.1 enabledB
SSL 3.0 enabledF
RC4 cipher enabledC
No Forward SecrecyB
Weak DH parametersB

Certificate Configuration

Requirements for Full Certificate Score

  • Valid (not expired)
  • Trusted chain (all intermediates included)
  • Domain matches (CN or SAN)
  • Strong key (2048-bit RSA minimum, 256-bit ECDSA)
  • SHA-256 signature (not SHA-1)

Check Your Certificate

# Check key size
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN 2>/dev/null | \
  openssl x509 -noout -text | grep "Public-Key"

# Check signature algorithm
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN 2>/dev/null | \
  openssl x509 -noout -text | grep "Signature Algorithm"

Fix: Complete Certificate Chain

See F5 Certificate Chain Configuration for detailed instructions.

Quick check:

# Should return 2 or more
echo | openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN 2>/dev/null | \
  grep -c "BEGIN CERTIFICATE"

Protocol Configuration (TLS Versions)

Recommended Configuration

ProtocolStatusWhy
SSL 3.0Vulnerable (POODLE)
TLS 1.0Deprecated, caps at B
TLS 1.1Deprecated, caps at B
TLS 1.2Current standard
TLS 1.3Best security/performance

Configure in F5

Path: Local Traffic → Profiles → SSL → Client → [Profile] → Options

tmsh command:

# Disable old protocols
tmsh modify ltm profile client-ssl YOUR-PROFILE \
  options { no-tlsv1 no-tlsv1.1 }

# Verify
tmsh list ltm profile client-ssl YOUR-PROFILE options

GUI:

  1. Edit Client SSL Profile
  2. Under Configuration, select Advanced
  3. In Options, add: No TLSv1 and No TLSv1.1
  4. Click Update

Verify TLS Versions

# Test TLS 1.2 (should work)
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN -tls1_2

# Test TLS 1.3 (should work)
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN -tls1_3

# Test TLS 1.1 (should FAIL)
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN -tls1_1

# Test TLS 1.0 (should FAIL)
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN -tls1

Cipher Configuration

Recommended Cipher String for A+

ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!MD5:!DSS

This provides:

  • Forward Secrecy (ECDHE, DHE)
  • Strong encryption (AES-GCM, ChaCha20)
  • No weak algorithms

Alternative: More Compatible (Still A+)

ECDHE+AESGCM:ECDHE+CHACHA20:ECDHE+AES:DHE+AESGCM:DHE+AES:!aNULL:!MD5:!DSS:!RC4:!3DES

Adds CBC mode AES for older clients.

Configure in F5

tmsh:

# Set cipher string
tmsh modify ltm profile client-ssl YOUR-PROFILE \
  ciphers 'ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!MD5:!DSS'

# Verify
tmsh list ltm profile client-ssl YOUR-PROFILE ciphers

GUI:

  1. Edit Client SSL Profile
  2. Under Configuration, select Advanced
  3. In Ciphers, enter the cipher string
  4. Click Update

Verify Cipher Configuration

# See what ciphers F5 will offer
tmm --clientciphers 'YOUR-CIPHER-STRING'

# Test actual negotiation
openssl s_client -connect YOUR-VIP:443 -servername YOUR-DOMAIN 2>/dev/null | \
  grep "Cipher is"

Cipher Strings to AVOID

StringProblem
DEFAULTIncludes weak ciphers
ALLIncludes everything, even insecure
RC4Broken, caps at C
3DESSlow and weak
MD5Weak hash
!ECDHE:!DHENo forward secrecy, caps at B

Enable HSTS (Required for A+)

HSTS (HTTP Strict Transport Security) tells browsers to only use HTTPS. Required for A+ grade.

Option 1: iRule (Quick Method)

# Create iRule
when HTTP_RESPONSE {
    HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
}

tmsh:

# Create iRule
tmsh create ltm rule HSTS-Header {
when HTTP_RESPONSE {
    HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
}
}

# Assign to virtual server
tmsh modify ltm virtual YOUR-VS rules { HSTS-Header }

Option 2: HTTP Profile (F5 v14+)

Path: Local Traffic → Profiles → Services → HTTP → [Profile] → HSTS

  1. Enable HSTS Mode
  2. Set HSTS Maximum Age to 31536000 (1 year)
  3. Enable Include Subdomains if applicable
  4. Enable HSTS Preload if submitting to preload list

Verify HSTS Header

curl -sI https://YOUR-DOMAIN | grep -i strict

# Should see:
# Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

HSTS Values

max-ageDurationSSL Labs Requirement
157680006 monthsMinimum for A+
315360001 yearRecommended
630720002 yearsBest for preload

Additional Optimizations

Enable OCSP Stapling

Improves performance and avoids CA availability issues.

Path: Local Traffic → Profiles → SSL → Client → [Profile] → OCSP Stapling

  1. Create OCSP Stapling profile first
  2. Assign to Client SSL profile
  3. Select in Certificate Key Chain

Cipher Server Preference

Force F5 to choose the cipher instead of the client.

tmsh modify ltm profile client-ssl YOUR-PROFILE \
  options add { cipher-server-preference }

Or in Options, add Cipher Server Preference.

Complete A+ Configuration

tmsh Commands (Copy-Paste Ready)

# Step 1: Update cipher string
tmsh modify ltm profile client-ssl YOUR-PROFILE \
  ciphers 'ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!MD5:!DSS'

# Step 2: Disable old TLS versions
tmsh modify ltm profile client-ssl YOUR-PROFILE \
  options { no-tlsv1 no-tlsv1.1 cipher-server-preference }

# Step 3: Create HSTS iRule
tmsh create ltm rule HSTS-Header {
when HTTP_RESPONSE {
    HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains"
}
}

# Step 4: Assign iRule to virtual server
tmsh modify ltm virtual YOUR-VS rules add { HSTS-Header }

# Step 5: Save configuration
tmsh save sys config

Verification Commands

# Test TLS versions
openssl s_client -connect YOUR-VIP:443 -tls1_2  # Should work
openssl s_client -connect YOUR-VIP:443 -tls1    # Should fail

# Test cipher
openssl s_client -connect YOUR-VIP:443 | grep "Cipher is"

# Test HSTS
curl -sI https://YOUR-DOMAIN | grep -i strict

# Test chain
openssl s_client -connect YOUR-VIP:443 -showcerts 2>/dev/null | grep -c "BEGIN CERT"

Troubleshooting Common Grade Issues

Grade Capped at B: "TLS 1.0 or 1.1 enabled"

# Fix: Disable old protocols
tmsh modify ltm profile client-ssl YOUR-PROFILE options add { no-tlsv1 no-tlsv1.1 }

Grade Capped at B: "No Forward Secrecy"

# Fix: Use ECDHE/DHE ciphers
tmsh modify ltm profile client-ssl YOUR-PROFILE \
  ciphers 'ECDHE+AESGCM:ECDHE+AES:DHE+AESGCM:DHE+AES:!aNULL:!MD5'

Grade Capped at A (Not A+): "No HSTS"

See Section 5 - add HSTS header via iRule or HTTP profile.

"Chain Issues: Contains anchor"

You're sending the root CA certificate - remove it from your chain.

"Chain Issues: Incomplete"

Missing intermediate certificate - see F5 Certificate Chain Configuration.

"This server is vulnerable to..."

Check the specific vulnerability and patch/configure accordingly:

  • POODLE: Disable SSL 3.0
  • BEAST: Disable TLS 1.0 or use RC4 (but RC4 is worse)
  • CRIME: Should be disabled by default in modern F5
  • Heartbleed: Update F5 software

A+ Configuration Checklist

Certificate

  • Valid (not expired)
  • SHA-256 or better signature
  • 2048-bit RSA or 256-bit ECDSA minimum
  • Complete chain (intermediates included)
  • Domain names match

Protocol

  • TLS 1.2 enabled
  • TLS 1.3 enabled (if supported)
  • TLS 1.0 disabled
  • TLS 1.1 disabled
  • SSL 3.0 disabled

Ciphers

  • Forward Secrecy enabled (ECDHE/DHE)
  • No RC4
  • No 3DES
  • No MD5
  • Cipher server preference enabled

HSTS

  • Header present
  • max-age at least 15768000 (6 months)
  • includeSubDomains (if applicable)

Testing Your Configuration

  1. Run SSL Labs test: ssllabs.com/ssltest
  2. Review each section for warnings
  3. Address any issues using this guide
  4. Re-test until you achieve A+

Expected Results for A+

Certificate:100%
Protocol Support:100%
Key Exchange:90-100%
Cipher Strength:90-100%
Grade: A+

Frequently Asked Questions

Related Resources

F5 SSL Profiles Explained

Foundation for all F5 SSL configuration and cipher settings.

F5 Certificate Chain Configuration

Fix incomplete chain issues that can drop your grade.

F5 SSL Troubleshooting

Debug and resolve common SSL/TLS issues on BIG-IP.

Cipher Suite Decoder

Understand cipher components to build a secure cipher string.

How TLS Works

Deep dive into TLS handshakes and protocol security.

Chain Builder Demo

Validate certificate chains before deployment.