Configure SSL ciphers to securely access the Management Service

You can select SSL cipher suites from a list of SSL ciphers supported by Citrix ADC SDX appliances. Bind any combination of the SSL ciphers to access the SDX Management Service securely through HTTPS. An SDX appliance provides 37 predefined cipher groups, which are combinations of similar ciphers, and you can create custom cipher groups from the list of supported SSL ciphers.

Limitations

• Binding ciphers with key exchange = “DH” or “ECC-DHE” is not supported.
• Binding the ciphers with Authentication = “DSS” is not supported.
• 绑定密码不支持的一部分SSL ciphers list, or including these ciphers in a custom cipher group, is not supported.

Supported SSL Ciphers

The following table lists the supported SSL ciphers. The value in theProtocolcolumn is the lowest supported protocol. For example, if SSLv3 is listed, then SSLv3/TLSv1/TLSv1.1/TLSv1.2 are all supported.

Predefined cipher groups

The following table lists the predefined cipher groups provided by the SDX appliance.

View the predefined cipher groups

查看predefined cipher groups, on theConfigurationtab, in the navigation pane, expandManagement Service, and then clickCipher Groups.

Create custom cipher groups

You can create custom cipher groups from the list of supported SSL ciphers.

To create custom cipher groups:

1. On theConfigurationtab, in the navigation pane, expandManagement Service, and then clickCipher Groups.
2. In theCipher Groupspane, clickAdd.
3. In theCreate Cipher Groupdialog box, perform the following:
   1. In theGroup Namefield, enter a name for the custom cipher group.
   2. In theCipher Group Descriptionfield, enter a brief description of the custom cipher group.
   3. In theCipher Suitessection, clickAddand select the ciphers to include in the list of supported SSL ciphers.
   4. ClickCreate.

View existing SSL cipher bindings

查看existing cipher bindings, on theConfigurationtab, in the navigation pane, expandSystem, and then clickConfigure SSL SettingsunderSystem Settings.

Note:After upgrade to the latest version of the Management Service, the list of existing cipher suites shows the OpenSSL names. Once you bind the ciphers from the upgraded Management Service, the display uses the Citrix naming convention.

Bind ciphers to the HTTPS service

1. On theConfigurationtab, in the navigation pane, clickSystem.
2. In theSystempane, under System Settings, clickConfigure SSL Settings.
3. In theEdit Settingspane, clickCiphers Suites.
4. In theCiphers Suitespane, do either of the following:
   • To choose a cipher group from the predefined cipher groups, selectCipher Groups, select a cipher group from theCipher Groupslist, and then clickOK.
   • To choose from the list of supported ciphers, select theCipher Suitescheck box, clickAddto select the ciphers, and then clickOK.