SSL connection issues, cipher questions

Our Network folks made SSL changes to a firewall.

PCI standards recommend using TLS 1.2 or higher. Per PCI DSS compliance and results from previous penetration test, it is recommended to disable TLS v1.1 due to deprecation and enable v1.3. Weak ciphers for TLS v1.2 were discovered during the penetration test and will be removed.

Below weak ciphers were removed, confirmed from*SCKSSL trace none of these are being used..
ECDHE_ECDSA_AES256_GCM_SHA384
ECDHE_ECDSA_AES128_GCM_SHA256
ECDHE_ECDSA_AES256_SHA384
ECDHE_ECDSA_AES128_SHA256
ECDHE_RSA_AES128_SHA256
AES256_GCM_SHA384
AES128_GCM_SHA256
AES256_SHA384
AESS128_SHA256
ECDHE_ECDSA_AES256_SHA
ECDHE_RSA_AES256_SHA
ECDHE_ECDSA_DES_CBC3_SHA
ECDHE_RSA_DES_CBC3_SHA
ECDHE_ECDSA_AES128_SHA
ECDHE_RSA_AES128_SHA
AES256_SHA
DHE_RSA_AES256_SHA256
DHE_RSA_AES256_SHA
DHE_RSA_CAMELLIA256_SHA256
DHE_RSA_AES128_SHA256
DHE_RSA_AES128_SHA
DHE_RSA_CAMELLIA128_SHA
EDH_RSA_DES_CBC3_SHA
CAMELLIA256_SHA
DES_CBC3_SHA
AES128_SHA
CAMELLIA128_SHA
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256

An application not using any of these ciphers would no longer would connect.
Below is the output from an *SCKSSL trace, showing the protocol and cipher used.
TLSV1.2 ECDHE_RSA_WITH_AES_256_GCM_SHA384 10.5.23.5 10.5.206.26

Any ideas on why this application failed. Based on the traces, it still should have worked.
V7R3 latest CUME and most groups


Thank You
_____
Paul Steinmetz
IBM I Power9 Administrator
Pencor Digital Services

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 Work
610-826-9188 Fax
610-349-0913 Cell
610-377-6012 Home