× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. April 2015

RE: SSL ciphers

Tim,

This is good to know, I wasn't sure.
This makes sense because I did have some apps use the new 256 cipher that I recently added.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Tim Bronski
Sent: Wednesday, April 22, 2015 1:20 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL ciphers

The certificate and the cipher have nothing to do with one another.

On 4/22/2015 7:12 PM, Steinmetz, Paul wrote:
Could/would the iSeries WC cert affect the cipher negotiation?
I still have a SHA 1 WC cert, the new SHA 256 WC cert not yet enabled.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Pete Helgren
Sent: Wednesday, April 22, 2015 1:02 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL ciphers

Yes. The client requests the cipher suite and negotiates with the server. We are facing this right now with our friends at Google putting up a warning on in Chrome with SSL ciphers using SHA1. We will move to SHA 256 but then folks who are crazy enough to run Windows XP < SP3 will be rejected by our server. So the client checks with the server to see what compatible cipher suites are available.

In your case it sound like the old SHA 1 is being used (which is now considered insecure).

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 4/22/2015 10:34 AM, Steinmetz, Paul wrote:
Tim,

I want to understand this better.
I changed the iSeries SSL settings, raised the standards.
The remote server would also need the similar changes completed to stay compatible.
And this could all be outside of the application, at the OS level, whether it be Win or Linux.
So if the remote/client SSL cipher list had only one available, and it was *RSA_RC4_128_SHA, that would result in a failure.
So at this point, I need someone to confirm the remote/client SSL
settings, (both SSL version and/or cipher list) Is this correct?

Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.


--
Need secure FTP? Download your native sFTP solution here:
www.arpeggiosoftware.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.