Re: Interim Options for V7R1 Customers with Bank/CC Transactions

Responding only to the 'Cloud Provider' comment. I believe we would in theory qualify as 'acceptable' by using a VPN tunnel from their system to ours.

Not suggesting this as a 'best idea' of course but throwing that out there.

- Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 10/16/2017 2:08 PM, Bradley Stone wrote:

Ok, so I've been running into more and more customers using GETURI that are
running into the SSL Ciphers issue with V7R1.

I've spent more time than I like (unbillable of course, unless I should
bill IBM for doing their job lol) to admit trying to help them figure out
solutions, so I would like to hear what idea others have for interim
solutions while hardware/OS is updated.

Most are stuck because their hardware won't run V7R2 or up. And getting
new hardware in a week, set up and running is impossible. (It took me over
3 weeks just to renew my SWMA!)

Well, this SSL cipher thing is a little more difficult since it stops them
from communicating with bank/credit card as well as other web services that
are required for day to day operations. And really the first they hear
about it is when the bank/service provider updates their SSL cert and
things stop working suddenly.

I have a couple consulting customers that I use my own V7R3 system as a
proxy, but it's not something I want to keep doing.

I've suggested to others setting up a PC/*nix proxy internally to bounce
the requests from, but I'm finding in those cases the know how is lacking,
and I spend more time trying to explain/help them with only days to go
before total shutdown.

So, any other ideas? Or is a temporary local proxy really the best/only
way. Assume IBM i hardware/OS won't be able to be done for 3 months, but
in 2 weeks you have to move live to the new URL using the new SSL certs
with ciphers not supported on your OS.

Possibly a temp account at a cloud provider (Larry?) The problem there is
the communication would need to be SSL as well since it will have sensitive
data.

Bradley V. Stone
www.bvstools.com
MAILTOOL Benefit #9 <https://www.bvstools.com/mailtool.html>: Superior
debugging (when using MAILTOOL Plus) - Bypassing the IBM SMTP server means
that we can fully debug and track down sometimes hard to find problems.
Even the Trace TCP/IP Application (TRCTCPAPP) command won't be this
detailed!