Re: SSL ciphers

[Pete Helgren <pete@xxxxxxxxxx>]

Yes.  The client requests the cipher suite and negotiates with the 
server.  We are facing this right now with our friends at Google putting 
up a warning on in Chrome with SSL ciphers using SHA1.  We will move to 
SHA 256 but then folks who are crazy enough to run Windows XP < SP3 will 
be rejected by our server.  So the client checks with the server to see 
what compatible cipher suites are available.

In your case it sound like the old SHA 1 is being used (which is now 
considered insecure).

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 4/22/2015 10:34 AM, Steinmetz, Paul wrote:
> Tim,
>
> I want to understand this better.
> I changed the iSeries SSL settings, raised the standards.
> The remote server would also need the similar changes completed to stay compatible.
> And this could all be outside of the application, at the OS level, whether it be Win or Linux.
> So if the remote/client SSL cipher list had only one available, and it was *RSA_RC4_128_SHA, that would result in a failure.
> So at this point, I need someone to confirm the remote/client SSL settings, (both SSL version and/or cipher list)
> Is this correct?
>
> Paul