Re: Sysval QSSLPCL questions With TLS

Yes I know we need to do some updates. Hoping to get to TLS1.2 and TLS1.3
without PTF's or upgrade. New system is in the near future, but in the
meantime.
I did notice that ACS is using TLS1.3.
The issue we had was when one of the Windows servers was updated to NOT
allow TLS1 and TLS1.1 our programs that read SQL databases stopped working.
Those programs are using Scott K. jdbcr_h stuff (jdbc_ExecUpd,
JDBC_ExecCall,
jdbc_close, JDBC_ConnProp, jdbc_ExecUpd).
trying to make this work. Not sure if I can use something in the ConnProp.
TIA

On Tue, Nov 26, 2024 at 10:05 AM Rob Berendt <robertowenberendt@xxxxxxxxx>
wrote:

https://www.ibm.com/docs/en/i/7.3?topic=changes-tlsv13-protocol-has-been-enabled-system-ssltls

You can see that it was updated around 2023-04-11 so I would suggest

PTF's

dated after that. Actually, just get the latest is what I'd really
suggest. Actually I'd suggest upgrading to 7.5. :-)
see also the "For additional information..." section, and,
Parent topic:
Secure sockets layer (SSL) and Transport Layer Security (TLS) changes

On Tue, Nov 26, 2024 at 9:12 AM K Crawford <kscx3ksc@xxxxxxxxx> wrote:

I am currently on V7R3M0 TR7.
We need to start using TLS1.2 or TLS1.3. Near as I can tell we are

using

TLS1.1.
From what I am reading I should be able to change the sysval QSSLPCL

and

be

good. Change it to *OPSYS, *TLSV1.2, *TLSV1.1.
Near as I can tell this will take effect immediately?
Am I missing something?
To get to TLS1.3 I will need to get a PTF or update the OS?
Do I need to do anything with the sysvals QSSLCSL and QSSLCSLCTL also

(I

don't think so)?

Currently:
QSSLPCL is *OPSYS
QSSLCSLCTL is *OPSYS
QSSLCSL is
*AES_128_GCM_SHA256
*AES_256_GCM_SHA384
*CHACHA20_POLY1305_SHA256
*ECDHE_ECDSA_AES_128_GCM_SHA256
*ECDHE_ECDSA_AES_256_GCM_SHA384
*ECDHE_RSA_AES_128_GCM_SHA256
*ECDHE_RSA_AES_256_GCM_SHA384
*ECDHE_ECDSA_CHACHA20_POLY1305_SHA256
*ECDHE_RSA_CHACHA20_POLY1305_SHA256
*RSA_AES_128_GCM_SHA256
*RSA_AES_256_GCM_SHA384
*ECDHE_ECDSA_AES_128_CBC_SHA256
*ECDHE_ECDSA_AES_256_CBC_SHA384
*ECDHE_RSA_AES_128_CBC_SHA256
*ECDHE_RSA_AES_256_CBC_SHA384
*RSA_AES_128_CBC_SHA256
*RSA_AES_128_CBC_SHA
*RSA_AES_256_CBC_SHA256
*RSA_AES_256_CBC_SHA
*ECDHE_ECDSA_3DES_EDE_CBC_SHA
*ECDHE_RSA_3DES_EDE_CBC_SHA
*RSA_3DES_EDE_CBC_SHA
TIA


--
Kerwin Crawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

--
Kerwin Crawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.