RE: SSL ciphers

Could/would the iSeries WC cert affect the cipher negotiation?
I still have a SHA 1 WC cert, the new SHA 256 WC cert not yet enabled.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Pete Helgren
Sent: Wednesday, April 22, 2015 1:02 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL ciphers

Yes. The client requests the cipher suite and negotiates with the server. We are facing this right now with our friends at Google putting up a warning on in Chrome with SSL ciphers using SHA1. We will move to SHA 256 but then folks who are crazy enough to run Windows XP < SP3 will be rejected by our server. So the client checks with the server to see what compatible cipher suites are available.

In your case it sound like the old SHA 1 is being used (which is now considered insecure).

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 4/22/2015 10:34 AM, Steinmetz, Paul wrote:

Tim,

I want to understand this better.
I changed the iSeries SSL settings, raised the standards.
The remote server would also need the similar changes completed to stay compatible.
And this could all be outside of the application, at the OS level, whether it be Win or Linux.
So if the remote/client SSL cipher list had only one available, and it was *RSA_RC4_128_SHA, that would result in a failure.
So at this point, I need someone to confirm the remote/client SSL
settings, (both SSL version and/or cipher list) Is this correct?

Paul

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.