SSL settings
In order to ensure a high level of security we need to properly configure the SSL settings on NetScaler. Over the last couple of years there have been many known vulnerabilities in the SSL protocol that could allow for man-in-the-middle attacks. These included for instance Heartbleed, Beast, and so on.
But with the growing list of known vulnerabilities, it might be difficult to get an overview in order to ensure that our services are properly configured for the highest level of security.
Ssllabs.com (https://www.ssllabs.com/) offers a free service that allows us to test our external web services for SSL configuration. It tests all of the known vulnerabilities in the SSL/TLS protocol, and also tests different ciphers and the certificate.
So a good best practice is to configure our SSL settings to get an A+ score on the ssllabs test. In order to get A+ we need to do some changes to the default SSL settings:
Disable SSL 3
Enable TLS 1.2
RC4 ciphers must be disabled
Prefer EC DH ciphers...
