qualys-ssllabs-aplus.yaml

---
name: qualys-ssllabs-aplus
namespace: com.citrix.adc.stylebooks
version: "1.0"
display-name: "Qualys SSL LABS A+ SSL Configuration"
description: "This stylebook configures a Front-end SSL Profile with the settings and ciphers necessary to obtain an A+ rating with Qualys SSL Labs Scan"
schema-version: "1.0"
import-stylebooks:
  -
    namespace: netscaler.nitro.config
    prefix: ns
    version: "12.0"
  -
    namespace: com.citrix.adc.commontypes
    prefix: cmtypes
    version: "1.0"
  -
    namespace: com.citrix.adc.stylebooks
    prefix: stlb
    version: "1.0"
parameters:
  -
    name: sslprofilename
    label: "Qualys A+ SSL Profile Name"
    description: "Name of the SSL Profile"
    type: string
    key: true
    gui:
      updatable: true
    required: true
  -
    name: ssl-config
    label: SSL Parameters Config Section
    type: object
    gui:
      collapse_pane: true
    parameters:
      -
        name: ssl-cipher-suites
        label: SSL Ciphers
        type: string[]
        allowed-values:
          - TLS1.3-AES128-GCM-SHA256
          - TLS1.3-AES256-GCM-SHA384
          - TLS1.2-ECDHE-ECDSA-AES256-SHA384
          - TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384
          - TLS1.2-DHE-RSA-AES256-GCM-SHA384
          - TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256
          - TLS1.2-ECDHE-RSA-CHACHA20-POLY1305
          - TLS1.2-ECDHE-ECDSA-CHACHA20-POLY1305
          - TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
        required: true
      -
        name: ssl-protocols
        label: Allowed SSL Protocols
        description: "Which SSL Protocols should be allowed"
        type: object
        parameters:
          -
            name: tls11
            label: TLS 1.1
            type: boolean
            default: false
          -
            name: tls12
            label: TLS 1.2
            type: boolean
            default: true
         -
            name: tls13
            label: TLS 1.3
            type: boolean
            default: true

substitutions:
    tls11-selection:
        true: "ENABLED"
        false: "DISABLED"
    tls12-selection:
        true: "ENABLED"
        false: "DISABLED"
    tls13-selection:
        true: "ENABLED"
        false: "DISABLED"
components:
  -
    name: ssl-profile-comp
    type: ns::sslprofile
    properties: 
      cipherpriority: "0"
      cipherredirect: "DISABLED"
      cleartextport: 0
      clientauth: "DISABLED"
      clientauthuseboundcachain: "DISABLED"
      denysslreneg: "NONSECURE"
      dh: "DISABLED"
      dhcount: "0"
      dhekeyexchangewithpsk: "NO"
      dhkeyexpsizelimit: "DISABLED"
      dropreqwithnohostheader: "NO"
      encrypttriggerpktcount: "45"
      ersa: "ENABLED"
      ersacount: "0"
      feature: "SYSTEM"
      hsts: "ENABLED"
      includesubdomains: "YES"
      insertionencoding: "Unicode"
      invoke: false
      maxage: "157680000"
      name: $parameters.sslprofilename
      nonfipsciphers: "DISABLED"
      ocspstapling: "DISABLED"
      preload: "YES"
      prevsessionkeylifetime: "0"
      pushenctrigger: "Always"
      pushenctriggertimeout: "1"
      pushflag: "0"
      quantumsize: "8192"
      redirectportrewrite: "DISABLED"
      sendclosenotify: "YES"
      serverauth: "DISABLED"
      service: "0"
      sessionkeylifetime: "3000"
      sessionticket: "DISABLED"
      sessionticketkeyrefresh: "ENABLED"
      sessionticketlifetime: "300"
      sessreuse: "ENABLED"
      sesstimeout: "120"
      skipcaname: false
      skipclientcertpolicycheck: "DISABLED"
      snicert: false
      snienable: "DISABLED"
      snihttphostmatch: "CERT"
      ssl3: "DISABLED"
      sslimaxsessperserver: "10"
      sslinterception: "DISABLED"
      ssliocspcheck: "DISABLED"
      sslireneg: "DISABLED"
      ssliverifyservercertforreuse: "ENABLED"
      ssllogprofile: "SSL_Log"
      sslpfobjecttype: "0"
      sslprofiletype: "FrontEnd"
      sslredirect: "ENABLED"
      ssltriggertimeout: "100"
      strictcachecks: "NO"
      strictsigdigestcheck: "DISABLED"
      tls1: "DISABLED"
      tls11: $substitutions.tls11-selection[$parameters.tls11]
      tls12: $substitutions.tls11-selection[$parameters.tls12]
      tls13: $substitutions.tls11-selection[$parameters.tls13]
      tls13sessionticketsperauthcontext: "1"
      zerorttearlydata: "DISABLED"

      
  -
    name: sslprofile-sslcipher-binding-comp
    type: ns::sslprofile_sslcipher_binding
    properties:
      name?: $parameters.name
      #name: $parameters.name
      ciphername?: $parameters.ssl-cipher-suites
      cipherpriority?: $parameters.cipherpriority

 
outputs:
  -