Last updated on: 2023-07-24 10:18:39.

TLS_Server (object)

TLS server parameters (connections arriving to ADC)

Properties (* = required):

name type(s) default allowed values description
alertTimeout   “indefinite”   Specifies the duration of time, in seconds, for the system to try to close an SSL connection before resetting the connection. The default is ‘indefinite’. You can also specify ‘immediate’, or an integer.
allowExpiredCRL boolean false true, false Specifies if the CRL can be used even if it has expired
authenticationFrequency string “one-time” “one-time”, “every-time” Client certificate authentication frequency
authenticationInviteCA       AS3 pointer to declaration of CA Bundle used to invite client certificates
authenticationMode string “ignore” “ignore”, “request”, “require” Client certificate authentication mode
authenticationTrustCA       AS3 pointer to declaration of CA Bundle used to validate client certificates
c3dEnabled boolean false true, false Enables or disables SSL Client Certificate Constrained Delegation (C3D). The default is false
c3dOCSP object     Specifies SSL Client Certificate Constrained Delegation (C3D) OCSP object that the BIG-IP SSL should use to connect to the OCSP responder and check the client certificate status,Reference to a OCSP Cert Validator
c3dOCSPUnknownStatusAction string “drop” “drop”, “ignore” Specifies the BIG-IP action when the OCSP returns unknown status. The default is drop
cacheCertificateEnabled boolean false true, false Enables or disables (default) caching certificates by IP address and port number
cacheTimeout integer 3600 0 - 86400 Sets the cache timeout (in seconds)
certificates* array     Primary and (optional) additional certificates (order is significant, element 0 is primary cert)
cipherGroup object     Pointer to a cipherGroup. cipherGroup and ciphers are mutually exclusive, only use one.
ciphers string     Ciphersuite selection string. ciphers and cipherGroup are mutually exclusive, only use one.
class* string   “TLS_Server”  
crlFile object     Specifies the name of a file containing a list of revoked client certificates,Reference to a SSL CRL file
forwardProxyBypassAllowlist object     Specifies the data group name of hostname allowlist when both SSL forwardProxyEnabled & forwardProxyBypassEnabled features are set to true.,Reference to a Data Group
forwardProxyBypassEnabled boolean false true, false Enables or disables (default) SSL forward proxy bypass
forwardProxyEnabled boolean false true, false Enables or disables (default) SSL forward proxy
insertEmptyFragmentsEnabled boolean false true, false Enables a countermeasure against an SSL 3.0/TLS 1.0 protocol vulnerability affecting CBC ciphers. These ciphers cannot be handled by certain broken SSL implementations.
label string   “^[^x00-x1fx22#&*<>?x5b-x5d`x7f]*$” Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
ldapStartTLS string   “none”, “allow”, “require” Creates a client LDAP profile with the specified activation mode STARTTLS.
namingScheme string “numbered” “numbered”, “certificate” Scheme to use when naming generated tmsh configuration
remark string   “^[^x00-x1fx22x5cx7f]*$” Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
renegotiationEnabled boolean true true, false Controls on a per-connection basis how the system responds to mid-stream SSL reconnection requests.
requireSNI boolean false true, false When a client sends no or unknown SNI and Require SNI is false (default), the system uses the primary certificate, otherwise the system rejects the client
retainCertificateEnabled boolean true true, false When enabled, server certificate is retained in SSL session.
singleUseDhEnabled boolean false true, false Creates a new key when using temporary/ephemeral DH parameters. This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using strong primes (for example. when using DSA-parameters). If strong primes were used, it is not strictly necessary to generate a new DH key during each handshake, but F5 Networks recommends it. Enable the Single DH Use option whenever temporary or ephemeral DH parameters are used.
staplerOCSPEnabled boolean false true, false Specifies whether to enable OCSP stapling
tls1_0Enabled boolean true true, false Allow TLS 1.0 Ciphers.
tls1_1Enabled boolean true true, false Allow TLS 1.1 Ciphers.
tls1_2Enabled boolean true true, false Allow TLS 1.2 Ciphers.
tls1_3Enabled boolean false true, false Allow TLS 1.3 Ciphers. Note: tls1_3Enabled is only supported in tmos version 14.0+.

TLS_Server.c3dOCSP (object)

Specifies SSL Client Certificate Constrained Delegation (C3D) OCSP object that the BIG-IP SSL should use to connect to the OCSP responder and check the client certificate status Reference to a OCSP Cert Validator

Properties (* = required):

name type(s) default allowed values description
bigip string   “f5bigip” formatted string Pathname of existing BIG-IP OCSP Cert Validator
use string     AS3 pointer to OCSP Cert Validator declaration

TLS_Server.cipherGroup (object)

Pointer to a cipherGroup. cipherGroup and ciphers are mutually exclusive, only use one.

Properties (* = required):

name type(s) default allowed values description
bigip string   “f5bigip” formatted string Pathname of existing BIG-IP cipher group
use string     AS3 pointer to cipher group declaration

TLS_Server.crlFile (object)

Specifies the name of a file containing a list of revoked client certificates Reference to a SSL CRL file

Properties (* = required):

name type(s) default allowed values description
bigip string   “f5bigip” formatted string Pathname of existing BIG-IP SSL CRL file

TLS_Server.forwardProxyBypassAllowlist (object)

Specifies the data group name of hostname allowlist when both SSL forwardProxyEnabled & forwardProxyBypassEnabled features are set to true. Reference to a Data Group

Properties (* = required):

name type(s) default allowed values description
bigip string   “f5bigip” formatted string Pathname of existing BIG-IP Data Group
use string     AS3 pointer to Data Group declaration