× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



I upgraded an R&D LPAR from V7R1 to V7R3 today.
All went well.
I was surprised to see the upgraded V7R3 LPAR retained my custom V7R1 SSL settings.
I expected the OS upgrade to set SSL settings back to V7R3 defaults.
This was not the case.
I had to change the 3 SSL system settings back to V7R3 defaults.

QSSLCSL *SEC Secure sockets layer cipher specification list
QSSLCSLCTL *SEC Secure sockets layer cipher control
QSSLPCL *SEC Secure sockets layer protocols

Paul

From: Steinmetz, Paul
Sent: Tuesday, January 09, 2018 3:55 PM
To: 'Midrange Systems Technical Discussion'
Subject: V7R3 SSL system values and SSLCONFIG settings - is it ok to leave all at default?

I'm reviewing the SSL system values and in SST the SSLCONFIG default settings compared to my V7R1 user defined settings.
From what I'm seeing, default settings should be ok.
No need for any user defined as I currently have on V7R1.
Is this correct?

QSSLCSL *SEC Secure sockets layer cipher specification list
Sequence Cipher
number Suite
0
10 *ECDHE_ECDSA_AES_128_GCM_SHA256
20 *ECDHE_ECDSA_AES_256_GCM_SHA384
30 *ECDHE_RSA_AES_128_GCM_SHA256
40 *ECDHE_RSA_AES_256_GCM_SHA384
50 *RSA_AES_128_GCM_SHA256
60 *RSA_AES_256_GCM_SHA384
70 *ECDHE_ECDSA_AES_128_CBC_SHA256
80 *ECDHE_ECDSA_AES_256_CBC_SHA384
90 *ECDHE_RSA_AES_128_CBC_SHA256
100 *ECDHE_RSA_AES_256_CBC_SHA384
110 *RSA_AES_128_CBC_SHA256
120 *RSA_AES_128_CBC_SHA
130 *RSA_AES_256_CBC_SHA256
140 *RSA_AES_256_CBC_SHA
150 *ECDHE_ECDSA_3DES_EDE_CBC_SHA
160 *ECDHE_RSA_3DES_EDE_CBC_SHA
170 *RSA_3DES_EDE_CBC_SHA

QSSLCSLCTL *SEC Secure sockets layer cipher control
Cipher control . . . . *OPSYS

QSSLPCL *SEC Secure sockets layer protocols
Protocols
*OPSYS

DISPLAY/ALTER/DUMP
Running macro: SSLCONFIG -DISPLAY

Current configuration
SSL Eligible Default Protocol List . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Default Protocol List. . . . . . . : TLSv1.2
TLSv1.1
TLSv1.0
SSL Eligible Default Cipher Suites . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA
SSL Default Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256
ECDHE_ECDSA_AES_256_GCM_SHA384
ECDHE_RSA_AES_128_GCM_SHA256
ECDHE_RSA_AES_256_GCM_SHA384
RSA_AES_128_GCM_SHA256
RSA_AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
RSA_AES_128_CBC_SHA256
RSA_AES_128_CBC_SHA
RSA_AES_256_CBC_SHA256
RSA_AES_256_CBC_SHA
SSL Renegotiation without RFC 5746 . . : None
Minimum RSA key size . . . . . . . . . : 0 bits
SSL Client Hello Record Version . . . : Highest
SSL Client Hello Supports TLSv1.2 . . : Allowed
SSL Client Hello Supports TLSv1.1 . . : Allowed
SSL Server Requires RFC 5746 . . . . . : Off
SSL Client Requires RFC 5746 . . . . . : Off
SSL Default Elliptic Curve Named Curve List . : Secp521r1
Secp384r1
Secp256r1
SSL Supported Elliptic Curve Named Curve List . : Secp521r1
Secp384r1
Secp256r1
Secp224r1
Secp192r1
SSL Default Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
DISPLAY/ALTER/DUMP
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
SSL Supported Signature Algorithm List . . . . : ECDSA with SHA512
ECDSA with SHA384
ECDSA with SHA256
ECDSA with SHA224
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5
SSL Connection Counters . . . . . . . : Disabled
Netsecure Inspect Application Data . . : Allowed
Netsecure Telnet Server . . . . . . . : Disabled
Netsecure UDP . . . . . . . . . . . . : Enabled
Maximum Number of Global OCSP Response Cache Entries . . : NOLIMIT
ECDSA with SHA1
RSA with SHA512
RSA with SHA384
RSA with SHA256
RSA with SHA224
RSA with SHA1
RSA with MD5
SSL Connection Counters . . . . . . . : Disabled
Netsecure Inspect Application Data . . : Allowed
Netsecure Telnet Server . . . . . . . : Disabled
Netsecure UDP . . . . . . . . . . . . : Enabled
Maximum Number of Global OCSP Response Cache Entries . . : NOLIMIT
Object Flush Latency . . . . . . . . . : 500 ms
PTF Level . . . . . . . . . . . . . . : 1

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.