All NetScaler appliances support the ECDHE cipher group on the front end and the back end. On an SDX appliance, if an SSL chip is assigned to a VPX instance, the cipher support of an MPX appliance applies. Otherwise, the normal cipher support of a VPX instance applies.

For more information about the builds and platforms that support these ciphers, see Ciphers available on the NetScaler appliances.

ECDHE cipher suites use elliptical curve cryptography (ECC). Because of its smaller key size, ECC is especially useful in a mobile (wireless) environment or an interactive voice response environment, where every millisecond is important. Smaller key sizes save power, memory, bandwidth, and computational cost.

A NetScaler appliance supports the following ECC curves:

You can bind all five curves to the SSL front-end entities. By default, the curves are bound in the following order: X_25519, P_256, P_384,P_224,P_521. When you upgrade to release 14.1-12.x, the curve bindings in any existing SSL virtual servers and SSL profiles aren’t modified. To use X25519, you must modify the configuration and bind X25519 manually. Alternately, to add X25519 at the front of the list, use the 'ALL' ec_curve option in the bind ssl vserver or bind ssl profile commands. This command internally unbinds and binds all the curves in the default order.

You can bind the first four ECC curves to the SSL back-end entities. By default, all four curves are bound in the following order: P_256, P_384,P_224,P_521.

To change the order, you must first unbind all the curves, and then bind them in the desired order.