What is a TLS Security Profile, and what does it configure?

Short answer

A TLS Security Profile is a reusable set of settings that determines how the TLS connections TR7 sets up are established: Min. SSL Version / Max. SSL Version, Cipher Algorithms and Curve/ECDHE; only on the vService side, Post-Quantum Key Exchange, Restart Undefined TLS Requests, SSL Hardware Acceleration, SNI/Host Validation, OCSP Stapling, HSTS and Client Certificate Authentication (mTLS). It is defined on the Certificates & PKI → TLS Security Profiles screen and is selected on HTTP and L7 TCP vServices in the Details panel, in the SSL Security module, and on the Backend Service in the Backend SSL Security Profile field. Only the version range, the cipher list and the curves are applied to the Backend Service connection.

How Does It Work?

1. The certificate is selected separately in the Certificate field of the vService; the profile provides the rules of the TLS session established with that certificate.
2. The version, ciphers and curves offered by the client are intersected with the range of the profile; if there is no intersection, the connection is rejected in the handshake. If mTLS is on, a certificate is requested from the client and verified with the selected CAs.
3. After the connection is established, application layer protections such as SNI/Host validation and HSTS take effect on the HTTP vService.

Settings

The profile form consists of three sections (profile add form):

Section	Settings
TLS Settings (Frontend & Backend)	Min. SSL Version, Max. SSL Version, Cipher Algorithms (eight preset sets or Manual), Algorithm List (only with Manual), Curve/ECDHE; Import Ciphers / Export Ciphers above the list
Frontend-only Settings	Post-Quantum Key Exchange, Restart Undefined TLS Requests (turns off session tickets), SSL Hardware Acceleration, SNI/Host Validation, OCSP Stapling, HSTS (Strict-Transport-Security header) and its sub-settings HSTS Duration (max-age), Include Subdomains (includeSubDomains), Browser Preload List Flag (preload)
Client Certificate Verification (mTLS) — Frontend	Client Certificate Authentication (mTLS), Client Certificate Verification Type (Optional / Required), CA Certificate Files, CA Verification Error Strategy, CA Verification Errors to Ignore

Where Is It Applied?

Place	Applied settings
vService (Details → Frontend Settings → SSL Security)	All settings; HSTS and SNI/Host Validation are effective only on the HTTP vService
Backend Service (Backend SSL Security Profile)	Only the TLS Settings (Frontend & Backend) section: the version range, the cipher list and the curves (the curves if the engine version supports them)
Health Check	If it has no TLS selection of its own, the lowest version and the cipher list of the Backend Service profile
Network vService	Not used; TLS is not terminated

Details: Where the settings are applied. When the profile is changed, the configuration is reapplied to all the vService and Backend Service connections that use it.

The Default Profile

TR7 has a system-defined Default Profile; it does not appear in the list and cannot be edited or deleted (the default profile). When the SSL Security box is checked on the vService, this profile comes selected. Its values: Min. SSL Version TLSv1.1, no upper limit, Cipher Algorithms = Only Secure Ones (HIGH:!aNULL:!MD5), no curve selection, Restart Undefined TLS Requests on; all the other switches off. The new profile form opens filled in with these values.

No profile is applied to a vService on which the SSL Security box has never been checked; the version range and the cipher list remain at the defaults of the engine. The Backend SSL Security Profile field on the Backend Service has no Default Profile option; the field takes None or a defined profile.

In TR7

• Creating a profile: Certificates & PKI → TLS Security Profiles → Add; the Security Profile Name is entered, the sections are filled in and Add is clicked (how to add).
• Selecting on the vService: The vService is opened with Edit; in the Details panel, the SSL Security box under Frontend Settings is checked, the profile is selected and Save is clicked (profile selection on the vService). The box is listed only while an encrypted protocol is selected in at least one frontend row.
• Selecting on the Backend Service: The Backend Service is opened with Edit; the profile is selected in the Backend SSL Security Profile field that appears while SSL Service is on, and Edit is clicked (the profile in the Backend Service connection).
• Applications: For disabling TLS 1.0/1.1, How do I disable TLS 1.0/1.1; is TLS 1.3 supported?; for weak ciphers, How do I disable weak ciphers?; for HSTS, How do I add HSTS?.

Common Misconceptions

• "The profile also determines the TLS of the TR7 management interface." The TLS versions of the management interface are set separately with the Min. TLS Version and Max. TLS Version fields on the Management Access screen.
• "HSTS and mTLS are also applied in the Backend Service profile." Only the version range, the cipher list and the curves are applied to the Backend Service connection; the client certificate that TR7 will present to the server is selected in the Client Certificate Presented to Backend (mTLS) field on the Backend Service.
• "The cipher list also determines the TLS 1.3 suites." The cipher list limits the suites of TLS 1.2 and earlier versions; in TLS 1.3 connections, the TLS 1.3 suites of the engine are used.
• "The Used in counter shows all usages." The Used in tab in the preview counts only vService assignments; Backend Service usage does not appear here.

How it is done in the documentation

• TLS Security Profiles · What Is a TLS Security Profile?
• TLS Security Profiles · Where the Settings Are Applied
• TLS Security Profiles · The Default Profile
• TLS Security Profiles · Profile Add Form

Related questions

• How do I disable TLS 1.0/1.1; is TLS 1.3 supported?
• How do I disable weak ciphers?
• Can I authenticate clients with client certificates (mTLS)?