Description
Leveraging the HTTP/2 capability requires several specific SSL/TLS settings in order to function.
Environment
- Silverline WAF
- Silverline Shape Defense
- Silverline Layer 7 DoS
- Proxy/Proxies
Procedure
Requirements on Front End SSL Profiles
- Navigate to Config, then Proxy / App Configuration, then SSL Management
- Select the Front End SSL Profiles tab
- Select each profile that is going to be associated with an application to leverage HTTP/2
- Update the cipher string to include the string:
ECDHE- If using a SOC-curated cipher set
- Copy the string from the Cipher String box
- Then select custom - Static from the SSL Cipher dropdown
- Then enter the string:
ECDHE - Then paste in what you've copied
- Example result:
ECDHE:TLSv1_2+HIGH:TLSv1_1+HIGH:TLSv1+MEDIUM:TLSv1+HIGH:!RC4:!3DES:!RSA:!EXPORT:!MD5:!ADH:@STRENGTH
- If using a SOC-curated cipher set
- Under Advanced SSL Settings
- Ensure Renegotiation is disabled
- Update the cipher string to include the string:
Repeat the steps listed above for the Backend SSL profile, otherwise, a warning message as per below will be displayed.
*Suggestion: Create a copy of the "Silverline_Server_Default" Backend SSL profile, name it with an indicator that supports HTTP2, for example: "HTTP2_Silverline_Server_Default", and performs the changes described above for the Front End SSL profile.