It would be system settings and not done during CSR creation.
It appears as if TLS 1.0 is the highest supported version on V6R1:
https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_61/rzain/rzainrzaintls.htm
If there is still a way to use a higher version I would not be aware of it and would have to defer to someone more knowledgeable than me on the i.
Cypher suites are controlled via system values QSSLCSL and QSSLCSLCTL:
https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_61/rzain/rzainsyssllattributes.htm
-----Original Message-----
From: Tom [mailto:tomh@xxxxxxxxxxx]
Sent: Monday, March 28, 2016 12:02 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: RE: iSeries SSL, Comodo certificate - no green padlock on browser
We're at v6r1.
It was indeed the non-SSL assets listed on the page that was causing the issue.
I have no idea how to adjust the TLS or Cypher Suites - is that done thru PTF? Or when I created the CSR?
Thanks,
TomH
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Dan Lanza
Sent: Monday, March 28, 2016 10:44 AM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: RE: iSeries SSL, Comodo certificate - no green padlock on browser
I've downloaded and installed a 2048 byte SSL certificate from Comodo,
and I've enabled SSL in the server config pages and assigned the
certificate to the HTTP_SERVER. But I'm still not seeing a secure
page when I pull up https://idocket.com/testmain.htm
Not exactly sure what to look at - any pointers? Is it the
certificate? Or
some http setting(s) on iSeries that I should look at?
If you right click on the little document image next to "https" (In Chrome at least) you'll see a couple of reasons why you're not getting the green bar.
It looks like you are including assets which are not behind SSL (
http://www.idocket.com/images/pop_idcourts1.gif is just one I found). If both www and non-www point to the same server/site then it might be best to reference images and the like with relative paths (IE:
/images/pop_idcourts1.giv) so it will default to whatever protocol you are using.
Further you are still using TLS 1.0 which is no longer acceptable for PCI compliance standards. I'd think about switching to TLS 1.2 if possible.
Additionally it reports you are using out of date Cypher Suites. While I don't think this is preventing the green bar from displaying, you should probably think about using whichever Cypher Suites are considered most secure for your OS/release level.
midrange.com
