Remove the 3DES ciphers.
Steve Pitcher
iTech Solutions
Office: (203) 744-7854 Ext. 176
Mobile: (902) 301-0810
http://www.itechsol.com
http://www.iInTheCloud.com
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Tuesday, January 9, 2018 4:55 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave all at default?
I'm reviewing the SSL system values and in SST the SSLCONFIG default settings compared to my V7R1 user defined settings.
From what I'm seeing, default settings should be ok.
No need for any user defined as I currently have on V7R1.
Is this correct?
QSSLCSL *SEC Secure sockets layer cipher specification list
Sequence Cipher
number Suite
0
10 *ECDHE_ECDSA_AES_128_GCM_SHA256
20 *ECDHE_ECDSA_AES_256_GCM_SHA384
30 *ECDHE_RSA_AES_128_GCM_SHA256
40 *ECDHE_RSA_AES_256_GCM_SHA384
50 *RSA_AES_128_GCM_SHA256
60 *RSA_AES_256_GCM_SHA384
70 *ECDHE_ECDSA_AES_128_CBC_SHA256
80 *ECDHE_ECDSA_AES_256_CBC_SHA384
90 *ECDHE_RSA_AES_128_CBC_SHA256
100 *ECDHE_RSA_AES_256_CBC_SHA384
110 *RSA_AES_128_CBC_SHA256
120 *RSA_AES_128_CBC_SHA
130 *RSA_AES_256_CBC_SHA256
140 *RSA_AES_256_CBC_SHA
150 *ECDHE_ECDSA_3DES_EDE_CBC_SHA
160 *ECDHE_RSA_3DES_EDE_CBC_SHA
170 *RSA_3DES_EDE_CBC_SHA
QSSLCSLCTL *SEC Secure sockets layer cipher control
Cipher control . . . . *OPSYS
QSSLPCL *SEC Secure sockets layer protocols
Protocols
*OPSYS
DISPLAY/ALTER/DUMP
Running macro: SSLCONFIG -DISPLAY
Current configuration
SSL Eligible Default Protocol List . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Default Protocol List. . . . . . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Eligible Default Cipher Suites . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA SSL Default Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA SSL Renegotiation without RFC 5746 . . : None Minimum RSA key size . . . . . . . . . : 0 bits SSL Client Hello Record Version . . . : Highest SSL Client Hello Supports TLSv1.2 . . : Allowed SSL Client Hello Supports TLSv1.1 . . : Allowed SSL Server Requires RFC 5746 . . . . . : Off SSL Client Requires RFC 5746 . . . . . : Off SSL Default Elliptic Curve Named Curve List . : Secp521r1
Secp384r1
Secp256r1 SSL Supported Elliptic Curve Named Curve List . : Secp521r1
Secp384r1
Secp256r1
Secp224r1
Secp192r1 SSL Default Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
DISPLAY/ALTER/DUMP
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1 SSL Supported Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5 SSL Connection Counters . . . . . . . : Disabled Netsecure Inspect Application Data . . : Allowed Netsecure Telnet Server . . . . . . . : Disabled Netsecure UDP . . . . . . . . . . . . : Enabled Maximum Number of Global OCSP Response Cache Entries . . : NOLIMIT
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5 SSL Connection Counters . . . . . . . : Disabled Netsecure Inspect Application Data . . : Allowed Netsecure Telnet Server . . . . . . . : Disabled Netsecure UDP . . . . . . . . . . . . : Enabled Maximum Number of Global OCSP Response Cache Entries . . : NOLIMIT Object Flush Latency . . . . . . . . . : 500 ms PTF Level . . . . . . . . . . . . . . : 1
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
http://amzn.to/2dEadiD
midrange.com
