Specify a unique name for the client SSL profile.

Enable or disable the use of user-specified cipher suites. If enabled, you must specify a colon-separated, ordered list of a customized SSL cipher suites. See below.

Available only when the Customized SSL Cipher Flag is enabled (see above). Specify a colon-separated, ordered list of a customized SSL cipher suites.

Note: FortiADC will use the default SSL cipher suite if the field is left empty.

Ciphers are listed from strongest to weakest:

• ECDHE-ECDSA-AES256-GCM-SHA384
• ECDHE-ECDSA-AES256-SHA384

• ECDHE-ECDSA-CAMELLIA256-SHA384

• ECDHE-ECDSA-AES256-SHA
• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-ECDSA-AES128-SHA256

• ECDHE-ECDSA-CAMELLIA128-SHA256

• ECDHE-ECDSA-AES128-SHA
• ECDHE-ECDSA-DES-CBC3-SHA
• ECDHE-ECDSA-RC4-SHA
• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-SHA384

• ECDHE-RSA-CAMELLIA256-SHA384

• ECDHE-RSA-AES256-SHA
• DHE-RSA-AES256-GCM-SHA384
• DHE-RSA-AES256-SHA256

• DHE-RSA-CAMELLIA256-SHA256

• DHE-RSA-AES256-SHA

• DHE-RSA-CAMELLIA256-SHA

• AES256-GCM-SHA384
• AES256-SHA256
• AES256-SHA
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-SHA256

• ECDHE-RSA-CAMELLIA128-SHA256

• ECDHE-RSA-AES128-SHA
• DHE-RSA-AES128-GCM-SHA256
• DHE-RSA-AES128-SHA256

• DHE-RSA-CAMELLIA128-SHA256

• DHE-RSA-AES128-SHA
• AES128-GCM-SHA256
• AES128-SHA256
• AES128-SHA
• ECDHE-RSA-RC4-SHA
• RC4-SHA
• RC4-MD5
• ECDHE-RSA-DES-CBC3-SHA
• EDH-RSA-DES-CBC3-SHA
• DES-CBC3-SHA
• eNULL

Note: We recommend retaining the default list. If necessary, you can deselect the SSL ciphers that you do not want to support.

TLSv1.3 ciphers are listed as following:

• TLS_AES_256_GCM_SHA384
• TLS_AES_128_GCM_SHA256
• TLS_CHACHA20_POLY1305_SHA256
• TLS_AES_128_CCM_SHA256
• TLS_AES_128_CCM_8_SHA256

Note: This option only available if the TLSv1.3 is checked.

You have the following options:

• SSLv3
• TLSv1.0
• TLSv1.1
• TLSv1.2
• TLSv1.3

We recommend retaining the default list. If necessary, you can deselect SSL versions you do not want to support.

Note: FortiADC does not support session reuse for SSLv2 at the client side. Instead, a new SSL session is started.

Please make sure that the SSL versions are continuous. IF not, an error message should be returned.

Select the client certificate verify configuration object.

Available only when the Client Certificate Verify is selected. Required by default.

Allows to the same SSL client attempts to reconnect to this SSL server and requests a resumption of a previous SSL session.

Note: This feature doesn’t support TLSv1.3

Allows resuming TLS sessions by storing key material encrypted on the clients.

Note: This feature doesn’t support TLSv1.3

Disabled by default. When enabled, you must specify the client certificate forward header. See below.

When Client Certificate Forward is enabled (see above), specify the client certificate forward header.

By default, (SSL) Forward Proxy is disabled. When enabled, you'll have to configure additional settings noted below.

Require clients to use the TLS server name indication (SNI) extension to include the server hostname in the TLS client hello message. Then, the FortiADC system can select the appropriate local server certificate to present to the client.

Select a local certificate group that includes the certificates this virtual server presents to SSL/TLS clients. This should be the backend servers' certificate, NOT the appliance's GUI web server certificate. See Manage certificates.

This flag is meaningful only when you have configured OCSP stapling in Local Certificate Group.

By default, this option is disabled (unselected). In that case, FortiADC accepts all OCSP responses, including those in which the next update field is not set. If enabled, and the next update field is not set in an OCSP stapling response, FortiADC will not load this OCSP stapling response or present it to clients during the SSL/TLS handshake.

Enable or disable SSL renegotiation from the client side.

Note:

• The feature is disabled by default.
• When enabled, you must configure the options below.

Specify the minimum interval between two successive client-initiated SSL renegotiation requests. The unit of measurement can be second, minute, or hour, e.g., 100s, 20m, or 1h.

Note:

• The default is -1, which disables the function.
• 0 means ‘Indefinite’.
• FortiADC will terminate the connection once the threshold is exceeded.

Specify the pubkey length in Diffie Hellman. Default is 1024.

Specify the period in second (default), minute, or hour at which FortiADC will initiate SSL renegotiation.

Note: The default is 0, which disables the function.

Specify the amount (MB) of application data that must have been transmitted over the SSL connection whenFortiADC initiates SSL renegotiation.

Note: The default is 0, which disables the function.

Select one of the following:

• Request—FortiADC requests secure renegotiation of SSL connections.
• Require—(Default) Specifies thatFortiADC requires secure renegotiation of SSL connections. In this mode, FortiADC permits initial SSL handshakes from clients, but terminates renegotiation requests from clients that do not support secure renegotiation.
• Require Strict—FortiADC requires strict secure renegotiation of SSL connections. In this mode, FortiADC denies initial SSL handshakes from clients that do not support secure renegotiation.

Allows ADC to dynamically adjust the size of TLS records based on the state of the connection, in order to prevent bottlenecks caused by the buffering of TLS record fragments.

Note: The feature is disabled by default.

Select a Forward Proxy Certificate Caching rule.

Select a Forward Proxy Local Signing CA.

Select a Forward Proxy Intermediate CA Group.

Disabled by default. Enable it to let FortiADC forward Server Name Indication (SNI) from the client to the back end.

Enabled by default. In this case, you must specify the backend customized SS ciphers. See below.

Specify the customized SSL ciphers to be supported at the back end.

Select the cipher from the list to be supported at the back end.

TLSv1.3 ciphers are listed as following:

TLS_AES_256_GCM_SHA384

TLS_AES_128_GCM_SHA256

TLS_CHACHA20_POLY1305_SHA256

TLS_AES_128_CCM_SHA256

TLS_AES_128_CCM_8_SHA256

Note: This option only available if the backendTLSv1.3 is checked.

We recommend retaining the default list. If necessary, you can deselect SSL versions you do not want to support.

Note: FortiADC does not support session reuse for SSLv2 at the client side. Instead, a new SSL session is started.