Re: Sysval QSSLPCL questions With TLS

[K Crawford <kscx3ksc@xxxxxxxxx>]

I just found this in SST.  SSLCONFIG.
It looks like I can do TLSV1.3.

     DISPLAY/ALTER/DUMP
Running macro: SSLCONFIG                        -DISPLAY

Current configuration
  SSL/TLS Eligible Default Protocol List : TLSv1.3
                                           TLSv1.2
                                           TLSv1.1
                                           TLSv1.0
  SSL/TLS Default Protocol List. . . . . : TLSv1.3
                                           TLSv1.2
                                           TLSv1.1
                                           TLSv1.0

On Tue, Nov 26, 2024 at 8:12 AM K Crawford <kscx3ksc@xxxxxxxxx> wrote:

> I am currently on V7R3M0 TR7.
> We need to start using TLS1.2 or TLS1.3.  Near as I can tell we are using
> TLS1.1.
> From what I am reading I should be able to change the sysval QSSLPCL and
> be good.  Change it to *OPSYS, *TLSV1.2, *TLSV1.1.
> Near as I can tell this will take effect immediately?
> Am I missing something?
> To get to TLS1.3 I will need to get a PTF or update the OS?
> Do I need to do anything with the sysvals QSSLCSL and QSSLCSLCTL also (I
> don't think so)?
>
> Currently:
> QSSLPCL is *OPSYS
> QSSLCSLCTL is  *OPSYS
> QSSLCSL is
> *AES_128_GCM_SHA256
> *AES_256_GCM_SHA384
> *CHACHA20_POLY1305_SHA256
> *ECDHE_ECDSA_AES_128_GCM_SHA256
> *ECDHE_ECDSA_AES_256_GCM_SHA384
> *ECDHE_RSA_AES_128_GCM_SHA256
> *ECDHE_RSA_AES_256_GCM_SHA384
> *ECDHE_ECDSA_CHACHA20_POLY1305_SHA256
> *ECDHE_RSA_CHACHA20_POLY1305_SHA256
> *RSA_AES_128_GCM_SHA256
> *RSA_AES_256_GCM_SHA384
> *ECDHE_ECDSA_AES_128_CBC_SHA256
> *ECDHE_ECDSA_AES_256_CBC_SHA384
> *ECDHE_RSA_AES_128_CBC_SHA256
> *ECDHE_RSA_AES_256_CBC_SHA384
> *RSA_AES_128_CBC_SHA256
> *RSA_AES_128_CBC_SHA
> *RSA_AES_256_CBC_SHA256
> *RSA_AES_256_CBC_SHA
> *ECDHE_ECDSA_3DES_EDE_CBC_SHA
> *ECDHE_RSA_3DES_EDE_CBC_SHA
> *RSA_3DES_EDE_CBC_SHA
> TIA
>
>
> --
> Kerwin Crawford