Can I import/export cipher lists?

Short answer

Yes. The Export Ciphers (N) button in the TLS Security Profile form downloads the profile's currently active cipher list (the suites of the ready-made set or the Manual list) as a .txt file with one suite per line; N is the number of suites. The Import Ciphers button imports a text file of at most 16 KB: the Cipher Algorithms field switches to Manual and the Algorithm List is replaced with the recognized names in the file; unrecognized names are listed in a warning. WEB-CLI has no file transfer; the list is read with lb ssl-security show and written to a new profile with the --manualCipherAlgorithmList.N fields.

Problem: The Same Cipher Policy Is to Be Applied in Many Places

When the organization's security team publishes an approved cipher list, this list must be transferred exactly to the devices and profiles, and the existing configuration must also be exported for auditing. Selecting the list manually, one by one, among hundreds of options is error-prone.

Solution: Three Methods

Methods 1 and 2 are used together to move a profile's list to other profiles or to other devices; Method 3 does the same job from the command line.

Your situation	Suitable method
Getting the profile's list into a file	Method 1: Export Ciphers
Applying the list in a file to a profile	Method 2: Import Ciphers
Reading and writing the list from the command line	Method 3: WEB-CLI

Method 1: Export Ciphers Recommended

• How it works The profile's currently active list (the suites of the selected ready-made set or the Manual list) is downloaded with one suite per line; the file name follows the ciphers_<set>_<hourminute_daymonthyear>.txt pattern (e.g. ciphers_strictSecure_1435_01102026.txt).
• Where it is openedCertificates & PKI → TLS Security Profiles → Add / Edit → Export Ciphers (N)
• Requirement None
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → TLS Security Profiles screen, the profile is selected and Edit is clicked (TLS Security Profiles).

2

Adım 2 Export

The Export Ciphers (N) button above the Cipher Algorithms field is clicked; when the button is hovered over, the list is shown. The file is downloaded to the browser's download folder. If the form was not changed, it can be closed without saving.

Verification

1FileDownloaded file

The lines in the file are counted.

Command: wc -l ciphers_strictSecure_1435_01102026.txt

ExpectedOne suite per line; N suites in total

Method 2: Import Ciphers

• How it works The names in the file are separated by spaces or line breaks and compared with the cipher list items that TR7 recognizes; names containing * add all the matching items as wildcards. The recognized names are written to the Algorithm List in the order in the file, and Cipher Algorithms becomes Manual.
• Where it is openedCertificates & PKI → TLS Security Profiles → Add / Edit → Import Ciphers
• Requirement A text file of at most 16 KB that contains the cipher names
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

On the Certificates & PKI → TLS Security Profiles screen, Add is clicked for a new profile, or an existing profile is selected and Edit is clicked.

2

Adım 2 Select the file

Import Ciphers is clicked and the file is selected. Unrecognized names are listed in the CIPHERS NOT ADDED warning and are not added; if there is not even a single recognized name in the file, only the Invalid input warning appears and the form does not change. A file larger than 16 KB is rejected with the File is too big warning.

3

Adım 3 Check the list

It is seen that the Cipher Algorithms field has switched to Manual and that the Algorithm List has been filled in the order in the file; the previous list has been completely replaced.

4

Adım 4 Save the profile

Add (or Edit) at the bottom of the form is clicked; the list is applied only when the profile is saved, and it is reapplied to the vServices that use the profile.

Verification

1ListTR7 side

When the profile is reopened, the number on the Export Ciphers (N) button is the same as the number of recognized names in the file; in the list, the Cipher Algorithms column of the profile shows the suites.

ExpectedManual · N suites

Method 3: WEB-CLI

• How it works The profile's list is read on the command line, and the same suites are written to a new profile in order. A file cannot be imported or exported.
• Where it is opened TR7 WEB-CLI → lb ssl-security show · lb ssl-security add
• Requirement WEB-CLI access
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Read the current list

In place of <profile>, the profile name is selected with Tab (command summary):

lb ssl-security show <profile>

The manualCipherAlgorithmList.0, .1 … lines in the output show the list in order.

2

Adım 2 Write the list to a new profile

The suites are written to a new profile in the same order; items that start with ! are exclusions:

lb ssl-security add name kurum-cipher --minSslVersion TLSv1.2 --cipherAlgorithm manual --manualCipherAlgorithmList.0 ECDHE+AESGCM --manualCipherAlgorithmList.1 ECDHE+CHACHA20 --manualCipherAlgorithmList.2 !SHA1

If the list of an existing profile is updated with --manualCipherAlgorithmList.N, the written position replaces the item there, and the remaining items of a longer old list are not deleted; to build the list from scratch, a new profile is created or Method 2 is used.

Verification

1RecordTR7 side

The new profile is displayed.

Command: lb ssl-security show kurum-cipher

ExpectedcipherAlgorithm manual · manualCipherAlgorithmList.0 ECDHE+AESGCM

Common Mistakes

• Thinking that importing will keep the current ready-made set. Importing switches the field to Manual and completely replaces the list with the ones in the file.
• Forgetting to save after importing. The list is applied only when the profile is saved.
• Thinking that the whole list is rejected because of a single unrecognized name. Only the unrecognized names are not added; the recognized ones are added, and the ones not added are listed in the warning.
• Importing the full OpenSSL string on a single line. The names in the file are separated by spaces and line breaks; a string joined with :, such as ECDHE+AESGCM:!SHA1, is counted as a single name and is not recognized. Each item is written on a separate line.

How it is done in the documentation

• TLS Security Profiles · Import Ciphers / Export Ciphers
• TLS Security Profiles · Algorithm List
• WEB-CLI · lb ssl-security

Related questions

• How do I disable weak ciphers?
• What is a TLS Security Profile, and what does it configure?
• What should I do to get an A+ from SSL Labs?