Thank you Scott. Believe it or not I found the same question I asked you a couple of years ago. (Well further back than that but I don't want to date myself.)
I have downloaded your SSLClient and SSLSever code from iProDeveloper and have two systems talking.
I was looking a building a service program that I can do something like:
CrtSSLclientConnection
URL
Port
and return the descriptor to do the selects, reads, and writes to.
Make the application simple but the service program do the work.
Now if I do not specify a client certificate, I can still get a secure connection to the server, but don't identify myself. Is this a true statement?
The client does not have to have the GSK_OS400_Application_ID set or does it? I know a server does to present the correct SSL certificate but does the client? This is where I am fuzzy brained.
Chris Bipes
Director of Information Services
CrossCheck, Inc.
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Scott Klement
Sent: Wednesday, November 05, 2014 1:18 PM
To: Midrange Systems Technical Discussion
Subject: Re: RPG SSL Sockets
Here's some acticles I wrote on SSL from RPG, quite a while back, but I
don't think anything has changed:
http://iprodeveloper.com/rpg-programming/ssl-sockets-rpg-course-you-can
http://iprodeveloper.com/rpg-programming/ssl-programming-rpg
I typically let the OS choose which version of SSL/TLS it uses. That
way, as vulnerabilities are found in stuff like SSL 3.0, IBM will
disable them in the OS, and we don't have to modify the application.
Likewise, as newer versions are added to the OS (TLS 1.1, TLS 1.2, etc)
it can pick those up automatically.
midrange.com
