Re: Disabling SSL version TLSV1 - only allowing TLSV1.1 and TLSV1.2

[Bradley Stone <bvstone@xxxxxxxxx>]

Are you referring to changing the system values on your IBM i to only use
TLS v1.1 and 1.2?

I would think by now that Client Access would be updated to work with
this.  It sounds like you can set your IBM i to use the right versions of
TLS but the clients that connect to it don't have the ability yet.

It may also mess up any client appcliations on the IBM i that connect via
SSL if you're on V7R1 and not up on PTFs.

I have one customer using GETURI that when they make the change they get
the -13 NOT_SUPPORTED error, but it works find on V7R2 so it must be a some
hyper PTF that isn't included.

Brad
www.bvstools.com

On Tue, Jun 2, 2015 at 8:58 AM, Matt Olson <Matt.Olson@xxxxxxxx> wrote:

> If you follow this guide you will be golden with TLS and a bunch more
> important security items:
>
> Linux flavors:
>
> https://sethvargo.com/getting-an-a-plus-on-qualys-ssl-labs-tester/
>
> Windows:
>
>
> https://scotthelme.co.uk/getting-an-a-on-the-qualys-ssl-test-windows-edition/
>
> More info on windows:
>
>
> http://www.dotnetnoob.com/2013/10/hardening-windows-server-20082012-and.html
>
>
>
> -----Original Message-----
> From: Steinmetz, Paul [mailto:PSteinmetz@xxxxxxxxxx]
> Sent: Tuesday, June 02, 2015 8:36 AM
> To: 'Midrange Systems Technical Discussion'
> Subject: Disabling SSL version TLSV1 - only allowing TLSV1.1 and TLSV1.2
>
> To all,
>
> I was just informed that *TLSV1 no longer passes PCI compliancy and must
> be also be disabled.
> Every one of my SSL connections is TLSV1.
> Has anyone disabled TLSV1, only left TLSV1.1 and TLSV1.2 enabled?
>
> Our IT staff informed me that most of our remote servers and applications
> may need a combination of OS upgrades, application upgrades,  and/or
> application default changes.
>
> I disabled TLSV1 on my playground LPAR, my PC would no longer connect SSL
> via client access.
>
> This is looking very ugly.
>
> I'm looking for some good SSL links for various OS (i5OS, Windows, CentOS)
> and application links also.
>
> Thank You
> _____
> Paul Steinmetz
> IBM i Systems Administrator
>
> Pencor Services, Inc.
> 462 Delaware Ave
> Palmerton Pa 18071
>
> 610-826-9117 work
> 610-826-9188 fax
> 610-349-0913 cell
> 610-377-6012 home
>
> psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
> http://www.pencor.com/
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at http://archive.midrange.com/midrange-l.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.