RE: DCM Key for CSR

Justin,

Take a look at the following Stack Exchange link as it seems to match your
question.

https://security.stackexchange.com/questions/133409/link-between-cipher-suit
es-and-certificate-key

You can also consider adding both the RSA and ECDSA Certificates to a
server.

Multiple certificate selection

https://www.ibm.com/docs/en/i/7.5?topic=tls-multiple-certificate-selection

It says "The purpose of multiple certificates is to enable the use of
Elliptic Curve Digital Signature Algorithm (ECDSA) certificates while still
allowing RSA certificates to be used with clients that require RSA."

You can remove the undesired cipher suites from system value QSSLCSL so they
will not be selected but the handshake will have to find a Cipher Suite they
both support for the TLS protocol to create a successful connection. You
will also need to set System Value QSSLCSLCTL to *OPSYS.

Try to avoid any Cipher Suites in the Weak Cipher Suites section of the
following document.

https://www.ibm.com/docs/en/i/7.5?topic=settings-cipher-suite-configuration

It would seem strange if older clients support ECDSA and do not also support
stronger Cipher Suites.

Were fortunate on the IBM i that all these cryptographic protocols and
algorithms are built into the operating system where most other platforms
have packages that perform the Server and transmission functions.
Frequently those packages are very old and haven't been patched in years so
they lack support for newer algorithms.


.