Cipher statements

[scott.w.richards]

We have an issue with International users vs. domestic users in that if we use 128-bit encryption, International users might have issues connecting.

My question is if we can use multiple Cipher statements to cover International users that require 40-bit encryption connections, while ensuring domestic users connect at 128-bit. If at all possible I don't want to implement the "all-cipher-suites", but accomplish this with multiple cipher statements in the ssl-proxy-list.

Any assistance or comments would be greatly appreciated.

[seilsz]

You can have multiple cipher statements in an ssl-proxy-list, but you can't tell the CSS to limit cipher usage to a certain subset of clients.

What about configuring different content rules for both domestic and international users? Each content rule could point to a different service, which would in turn point to a different ssl-proxy-list, each with different ciphers configured. You could specify a different URL and/or IP address for domestic vs. international users, and ensure the client gets directed correctly using DNS.

~Zach