F5 BIG-IP SSL Profiles Explained

F5 and SSL/TLS: What BIG-IP Is Actually Doing

Despite F5's long-standing use of the term "SSL," BIG-IP handles modern TLS — not SSL. SSL 2.0 and 3.0 are deprecated and disabled by default; TLS 1.2 is the current baseline, and TLS 1.3 is supported on BIG-IP 14.0 and later, where it is auto-negotiated once enabled in the profile options.

The naming "SSL profile" is historical. When you configure an F5 SSL/TLS profile today, you are controlling TLS exclusively. Keep this in mind when reading F5 documentation or ticket notes — "SSL profile" and "TLS profile" refer to the same object.

What is an SSL Profile?

An SSL profile is a reusable collection of SSL/TLS settings. Instead of configuring encryption settings directly on each virtual server, you create profiles and attach them. On F5 BIG-IP, this is the standard way to manage certificates, cipher suites, and TLS version policy across your entire deployment.

The Two Types of SSL Profiles

F5 has two types of SSL profiles, and the naming confuses everyone.

                        F5 BIG-IP
                     ┌─────────────────┐
                     │                 │
[Client/Browser] ────▶  Virtual Server  ────▶ [Backend Server]
                HTTPS │                 │ HTTP or HTTPS
                     │  ┌───────────┐  │
                     │  │Client SSL │  │  ◀── Decrypts INCOMING traffic
                     │  │ Profile   │  │      YOUR certificate goes here
                     │  └───────────┘  │
                     │                 │
                     │  ┌───────────┐  │
                     │  │Server SSL │  │  ◀── Encrypts OUTGOING traffic
                     │  │ Profile   │  │      Only needed for re-encryption
                     │  └───────────┘  │
                     │                 │
                     └─────────────────┘

Quick Reference Table

*Only if backend requires client certificate authentication (mTLS)

Why The Names Are Confusing

The naming is from F5's perspective, not yours.

When You Need Each Profile

Does F5 need to see the traffic content?
│
├── YES (modify headers, route by URL, inspect payload)
│   │
│   └── Create Client SSL Profile with your certificate
│       │
│       └── Does backend need HTTPS?
│           │
│           ├── YES → Also create Server SSL Profile
│           │
│           └── NO → Client SSL only (SSL Offload)
│
└── NO (just route encrypted packets)
    │
    └── Use SSL Passthrough (no SSL profiles)

Anatomy of a Client SSL Profile

Location: Local Traffic → Profiles → SSL → Client

Key Settings Explained

Anatomy of a Server SSL Profile

Location: Local Traffic → Profiles → SSL → Server

Key Settings Explained

Server Authentication: Ignore (don't verify backend cert)
Ciphers: Match your backend's supported ciphers
Options: TLS 1.2 minimum

Common Mistakes

Quick Reference Commands

# List all Client SSL profiles
tmsh list ltm profile client-ssl

# Show specific profile details
tmsh list ltm profile client-ssl my-profile all-properties

# List all certificates on the F5
tmsh list sys crypto cert

# Show certificate details
tmsh list sys crypto cert my-cert all-properties

# Check what ciphers a cipher string produces
tmm --clientciphers 'ECDHE+AES-GCM:ECDHE+AES'

# See all supported ciphers
tmm --clientciphers 'ALL'

Configuring TLS Versions and Ciphers on F5

Controlling which TLS versions and cipher suites BIG-IP accepts is done through the profile's Options list (for protocol versions) and the Cipher string or Cipher Group (for algorithms). Getting this right is critical for security compliance and interoperability.

Disable old TLS versions

Use the options field to explicitly disable legacy protocols. This forces clients to negotiate TLS 1.2 or higher:

tmsh modify ltm profile client-ssl <name> options { no-tlsv1 no-tlsv1.1 no-ssl-v3 }

Cipher Groups and Cipher Rules (BIG-IP 13.0+)

The modern approach is to use Cipher Groups and Cipher Rules rather than a legacy cipher string. Cipher Groups give you named, auditable sets of algorithms that you can reference from multiple profiles:

# List existing cipher rules
tmsh list ltm cipher rule

# Assign a cipher group to a Client SSL profile
tmsh modify ltm profile client-ssl <name> cipher-group <group-name>

Verify your changes

After modifying protocol or cipher settings, confirm the running configuration and then verify the negotiation from outside the box. Check the profile itself first:

tmsh list ltm profile client-ssl <name>

Then test what the VIP actually negotiates from a client machine. Use our SSL checker for a quick browser-based scan, or run openssl s_client from the command line to inspect the full handshake:

Next Steps

Now that you understand SSL profiles:

Frequently Asked Questions