Re: HTTPAPI and Ciphers on 7.1

[B Stone <bvstone@xxxxxxxxx>]

If the ciphers are newer and not on your system, there is zero chance
you'll get it to work.  IBM announced no new ciphers will be supported over
a year ago for V7R1.

It stinks.. I have customers in the same situation.  Some I have help do
this with a proxy (either a PC/nix box or another IBM i).  Make a request
to the proxy that supports the ciphers, the proxy makes the request to the
actual system, returns back through the chain.


Bradley V. Stone
www.bvstools.com
MAILTOOL Benefit #2 <https://www.bvstools.com/mailtool.html>: The ability
to specify a "From" and/or "Reply To" email address!

On Fri, May 1, 2020 at 12:43 PM Carter.Spencer <
Carter.Spencer@xxxxxxxxxxxxxxxxx> wrote:

> We have an existing relationship with a vendor where we exchange info with
> using HTTPAPI (ver 1.4).  They are updating their security to use TLS 1.2
> and 256 encryption.
> Our Power5 is stuck at OS 7.1 with no virtually no chance to be upgraded.
> I inherited this process so I don't fully understand it so I wanted to run
> it by you experts to verify we may need to find another system to
> communicate with them.
>
> Our QSSLPCL is:
> *TLSV1.2
> *TLSV1.1
>
> Our QSSLCSL is:
> *RSA_AES_256_CBC_SHA256
> *RSA_AES_128_CBC_SHA256
> *RSA_AES_128_CBC_SHA
> *RSA_AES_256_CBC_SHA
>
> The error I get when trying to communicate with them is:
> (GSKit) Peer not recognized or badly formatted message received.
> ssl_error(415): (GSKit) Peer not recognized or badly formatted message
> received.
>
> They say they are using openssl's 1.1.0 definition of ciphers matching
> HIGH.
> They did give me a file of their ciphers and there wasn't an exact match
> but these were the closest:
> SRP-RSA-AES-256-CBC-SHA
> SRP-RSA-AES-128-CBC-SHA
>
> I was expecting a different error message if it was just our ciphers not
> matching.  Regardless, is there no hope to get this working?
>
> Spencer Carter
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com