Re: V7R1 to V7R3 and existing self signed keys

I don't think so. Then again, is the cipher level tied to the key? That
would be a concern as 7.1 has no currently valid ciphers.

I think the bulk of the concern is that many browsers are red flagging
self signed keys. It's gotten so bad that IBM stopped defaulting the web
IBM Navigator for i from using https and started using http and gave you
instructions on how to load a certificate and turn https back on, if you
want to. This may be where you're getting a lot of your FUD on this issue
with 7.3.

There will be those who will argue until they are blue in the face that
self signed keys should be perfectly acceptable for internal use and that
you should spend days, weeks, months and years if need be trying to
convince your auditors. And that users should just always automatically
accept self signed keys and get into that habit for all websites, internal
or external. And that users should generally ignore any warning messages
about any security issue, self signed keys or otherwise.


Rob Berendt