Re: Relationship between SSL protocols and cipher specification list. -- MIDRANGE-L

It should be noted the TLS protocols TLSv1 and TLSv1.1 are disabled by default starting in IBM SDK, Java Technology Edition Java SR6 FP30 (8.0.6.30).
It may be necessary to re-enable these protocols for inbound clients that connect to the server, or for remote servers to which makes outbound connections.

Further details may be found under the “Service refresh 6 fix pack 30” heading at the page link below:

https://www.ibm.com/docs/en/sdk-java-technology/8?topic=wn-service-refresh-6

---------------------------------------------------
Nadir Amra
e-mail: amra@xxxxxxxxxx

From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of Rob Berendt <rob@xxxxxxxxx>
Reply-To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Date: Thursday, March 31, 2022 at 8:03 AM
To: midrange400 midrange400 midrange400 <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: [EXTERNAL] Relationship between SSL protocols and cipher specification list.

Let's avoid the irrelevant tangent that SSL is obsolete and TLS is current as the system values use SSL in their names, ok?

As much as I'd like to just use values like *OPSYS for some of these values and stay on the latest and most current I have this one customer who lags behind. We're trying to encourage them so let's avoid the tangents of why I shouldn't be doing this.

This customer is using the cipher *ECDHE_RSA_AES_256_CBC_SHA384
What we have is working, except when we switch over to the H/A machine. So I'm trying to piece together the primary and the backup lpars while still trying to use the most current on both with the exception of providing support for this one customer.

In order to support this cipher what protocol do I need to allow to support it? Will upgrading QSSLPCL from *TLSV1.2, *TLSV1.1, *TLSV1 to *TLSV1.3, *TLSV1.2 work or do I need to add one of the following also: *TLSV1.1, *TLSV1? If so, which one?

I know I have some SST stuff to do, like modifying TLSCONFIG as per
https://www.ibm.com/support/pages/configuring-your-ibm-i-system-secure-sockets-layer-ssltransport-layer-security-tls-protocols-and-cipher-suites

Part of this SST stuff makes me think that I really don't need *TLSV1.1 nor *TLSV1 in QSSLPCL as I show this in TLSCONFIG:
TLS Eligible Default Protocol List . . : TLSv1.3
TLSv1.2
TLS Default Protocol List. . . . . . . : TLSv1.2

TLS Eligible Default Cipher Suites . . : YF,YG,YB,YC,YD,YE,YH,YA,Y8,YI,YJ
AES_128_GCM_SHA256
AES_256_GCM_SHA384
ECDHE_ECDSA_AES_128_GCM_SHA256*
ECDHE_ECDSA_AES_256_GCM_SHA384*
ECDHE_RSA_AES_128_GCM_SHA256*
ECDHE_RSA_AES_256_GCM_SHA384*
CHACHA20_POLY1305_SHA256*
ECDHE_RSA_AES_256_CBC_SHA384*
ECDHE_ECDSA_AES_256_CBC_SHA384*
ECDHE_ECDSA_CHACHA20_POLY1305_SHA256*
ECDHE_RSA_CHACHA20_POLY1305_SHA256*

TLS Default Cipher Suite List. . . . . : ECDHE_ECDSA_AES_128_GCM_SHA256*
ECDHE_ECDSA_AES_256_GCM_SHA384*
ECDHE_RSA_AES_128_GCM_SHA256*
ECDHE_RSA_AES_256_GCM_SHA384*
ECDHE_RSA_AES_256_CBC_SHA384*
ECDHE_ECDSA_AES_256_CBC_SHA384*