Re: Disabling SSL version TLSV1 - only allowing TLSV1.1 and TLSV1.2

Are you referring to changing the system values on your IBM i to only use
TLS v1.1 and 1.2?

I would think by now that Client Access would be updated to work with
this. It sounds like you can set your IBM i to use the right versions of
TLS but the clients that connect to it don't have the ability yet.

It may also mess up any client appcliations on the IBM i that connect via
SSL if you're on V7R1 and not up on PTFs.

I have one customer using GETURI that when they make the change they get
the -13 NOT_SUPPORTED error, but it works find on V7R2 so it must be a some
hyper PTF that isn't included.

Brad
www.bvstools.com

On Tue, Jun 2, 2015 at 8:58 AM, Matt Olson <Matt.Olson@xxxxxxxx> wrote:

If you follow this guide you will be golden with TLS and a bunch more
important security items:

Linux flavors:

https://sethvargo.com/getting-an-a-plus-on-qualys-ssl-labs-tester/

Windows:


https://scotthelme.co.uk/getting-an-a-on-the-qualys-ssl-test-windows-edition/

More info on windows:


http://www.dotnetnoob.com/2013/10/hardening-windows-server-20082012-and.html



-----Original Message-----
From: Steinmetz, Paul [mailto:PSteinmetz@xxxxxxxxxx]
Sent: Tuesday, June 02, 2015 8:36 AM
To: 'Midrange Systems Technical Discussion'
Subject: Disabling SSL version TLSV1 - only allowing TLSV1.1 and TLSV1.2

To all,

I was just informed that *TLSV1 no longer passes PCI compliancy and must
be also be disabled.
Every one of my SSL connections is TLSV1.
Has anyone disabled TLSV1, only left TLSV1.1 and TLSV1.2 enabled?

Our IT staff informed me that most of our remote servers and applications
may need a combination of OS upgrades, application upgrades, and/or
application default changes.

I disabled TLSV1 on my playground LPAR, my PC would no longer connect SSL
via client access.

This is looking very ugly.

I'm looking for some good SSL links for various OS (i5OS, Windows, CentOS)
and application links also.

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.