Showing results for 
Search instead for 
Did you mean: 

TLS1.2 for cisco router webvpn

Andriy Sidko

Hi guys.


i'm trying to force router c891 webvpn to use TLS1.2 instead TLS1.0

using followin command:" ip https secure ciphersuite dhe-aes-cbc-sha2"

As per ip http secure ? help cipher above is using TLS1.2 but as far as client connected I can see from client anconnect cipher TLS1.0 in use.


Could somebody clarify what's wron?


Thank you.


Marvin Rhoads
VIP Community Legend VIP Community Legend
VIP Community Legend

Do you have an EC certificate (i.e., Elliptic Curve vs. the more common RSA) on your router?


I haven't done it yet with an IOS router but there isd a good writeup below for getting Anyconnect to use TLS 1.2 on an ASA. In the example, it was necessary to have an EC certificate installed and bound to the interface.

Thank you for reply.


not yet I don't have ECDSA certificate installed to router but if I'm not mistaked I can use regular RSA certificate with ciphersuite:


rsa-aes-cbc-sha2  -> Encryption type tls_rsa_with_aes_cbc_sha2 (TLS1.2 & Above) ciphersuite

rsa-aes-gcm-sha2 -> Encryption type tls_rsa_with_aes_gcm_sha2 (TLS1.2 & Above) ciphersuite


These ciphersuites require just RSA certificate to be installed. Is it correct?


unfortunately, whenever I tryed them client's anyconnect shows TLS1.0still in use.

Mohammad Alhyari
Cisco Employee
Cisco Employee


Tls1.2 is not yet available for webvpn/anyconnect. it has been added to the secure https server only via:

ENH: Enable support for TLSv1.1 & TLSv1.2 for http secure server/client
This is for webvpn and not yet implemented. Please wait and see if any update happens to this ENH:
CSCux73159 ENH: TLS1.2 Support for SSLVPN on IOS and IOS-XE

@Mohammad Alhyari,

Thanks for the link to that enhancement request.


If one is using an ASA (vs. IOS or IOS-XE), TLS 1.2 has been obesrved to work for AnyConnect when using next generation encryption.

Please refer to the following article:


He shows the following outcome from an AnyConnect client establishing a remote access VPN session:


Dec 17 2016 17:13:13: %ASA-7-725012: Device chooses cipher ECDHE-ECDSA-AES256-GCM-SHA384 for the SSL session with client outside:89.135.x.x/60831 to a.b.c.d/443

Dec 17 2016 17:13:13: %ASA-6-725016: Device selects trust-point DC1-EC-out for client outside:89.135.x.x/60831 to a.b.c.d/443

Dec 17 2016 17:13:14: %ASA-6-725002: Device completed SSL handshake with client outside:89.135.x.x/60831 to a.b.c.d/443 for TLSv1.2 session

That is for the ASA not the IOS.



Yes - I was editing my reply when you posted. :)

i see. Thank you Moh.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: