Relationship between SSL protocols and cipher specification list.

Let's avoid the irrelevant tangent that SSL is obsolete and TLS is current as the system values use SSL in their names, ok?

As much as I'd like to just use values like *OPSYS for some of these values and stay on the latest and most current I have this one customer who lags behind. We're trying to encourage them so let's avoid the tangents of why I shouldn't be doing this.

This customer is using the cipher *ECDHE_RSA_AES_256_CBC_SHA384
What we have is working, except when we switch over to the H/A machine. So I'm trying to piece together the primary and the backup lpars while still trying to use the most current on both with the exception of providing support for this one customer.

In order to support this cipher what protocol do I need to allow to support it? Will upgrading QSSLPCL from *TLSV1.2, *TLSV1.1, *TLSV1 to *TLSV1.3, *TLSV1.2 work or do I need to add one of the following also: *TLSV1.1, *TLSV1? If so, which one?

I know I have some SST stuff to do, like modifying TLSCONFIG as per
https://www.ibm.com/support/pages/configuring-your-ibm-i-system-secure-sockets-layer-ssltransport-layer-security-tls-protocols-and-cipher-suites

Part of this SST stuff makes me think that I really don't need *TLSV1.1 nor *TLSV1 in QSSLPCL as I show this in TLSCONFIG:
TLS Eligible Default Protocol List . . : TLSv1.3
TLSv1.2
TLS Default Protocol List. . . . . . . : TLSv1.2

TLS Eligible Default Cipher Suites . . : YF,YG,YB,YC,YD,YE,YH,YA,Y8,YI,YJ
AES_128_GCM_SHA256
AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_GCM_SHA256*
ECDHE_ECDSA_AES_256_GCM_SHA384*
ECDHE_RSA_AES_128_GCM_SHA256*
ECDHE_RSA_AES_256_GCM_SHA384*
CHACHA20_POLY1305_SHA256*
ECDHE_RSA_AES_256_CBC_SHA384*
ECDHE_ECDSA_AES_256_CBC_SHA384*
ECDHE_ECDSA_CHACHA20_POLY1305_SHA256*
ECDHE_RSA_CHACHA20_POLY1305_SHA256*



TLS Default Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256*
ECDHE_ECDSA_AES_256_GCM_SHA384*
ECDHE_RSA_AES_128_GCM_SHA256*
ECDHE_RSA_AES_256_GCM_SHA384*
ECDHE_RSA_AES_256_CBC_SHA384*
ECDHE_ECDSA_AES_256_CBC_SHA384*


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com