× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. November 2024

Re: Sysval QSSLPCL questions With TLS

That is interesting. I did not know that. I am not surprised.
If I understand correctly:
ACS is going to use the OS SSL/TLS. ACS is using TLS1.3 so it is good.
PASE SSL/TLS is something else that I am not using. Not sure what it is
using and at this time not too concerned about it.
Java SSL/TLS is what I need to update. Do I need to download a new Java?
I don't recall where to get that. Google here I come.
Kerwin


On Tue, Nov 26, 2024 at 11:28 AM Charles Wilt <charles.wilt@xxxxxxxxx>
wrote:

Note that the Java SSL/TLS stuff is completely separate from the OS SSL/TLS
stuff

Also PASE SSL/TLS is yet a third...
https://www.ibm.com/docs/en/i/7.4?topic=security-tls-implementations

HTH,

Charles

On Tue, Nov 26, 2024 at 10:03 AM K Crawford <kscx3ksc@xxxxxxxxx> wrote:

Yes I know we need to do some updates. Hoping to get to TLS1.2 and
TLS1.3
without PTF's or upgrade. New system is in the near future, but in the
meantime.
I did notice that ACS is using TLS1.3.
The issue we had was when one of the Windows servers was updated to NOT
allow TLS1 and TLS1.1 our programs that read SQL databases stopped
working.
Those programs are using Scott K. jdbcr_h stuff (jdbc_ExecUpd,
JDBC_ExecCall,
jdbc_close, JDBC_ConnProp, jdbc_ExecUpd).
trying to make this work. Not sure if I can use something in the
ConnProp.
TIA

On Tue, Nov 26, 2024 at 10:05 AM Rob Berendt <
robertowenberendt@xxxxxxxxx>
wrote:




https://www.ibm.com/docs/en/i/7.3?topic=changes-tlsv13-protocol-has-been-enabled-system-ssltls
You can see that it was updated around 2023-04-11 so I would suggest
PTF's
dated after that. Actually, just get the latest is what I'd really
suggest. Actually I'd suggest upgrading to 7.5. :-)
see also the "For additional information..." section, and,
Parent topic:
Secure sockets layer (SSL) and Transport Layer Security (TLS) changes

On Tue, Nov 26, 2024 at 9:12 AM K Crawford <kscx3ksc@xxxxxxxxx> wrote:

I am currently on V7R3M0 TR7.
We need to start using TLS1.2 or TLS1.3. Near as I can tell we are
using
TLS1.1.
From what I am reading I should be able to change the sysval QSSLPCL
and
be
good. Change it to *OPSYS, *TLSV1.2, *TLSV1.1.
Near as I can tell this will take effect immediately?
Am I missing something?
To get to TLS1.3 I will need to get a PTF or update the OS?
Do I need to do anything with the sysvals QSSLCSL and QSSLCSLCTL also
(I
don't think so)?

Currently:
QSSLPCL is *OPSYS
QSSLCSLCTL is *OPSYS
QSSLCSL is
*AES_128_GCM_SHA256
*AES_256_GCM_SHA384
*CHACHA20_POLY1305_SHA256
*ECDHE_ECDSA_AES_128_GCM_SHA256
*ECDHE_ECDSA_AES_256_GCM_SHA384
*ECDHE_RSA_AES_128_GCM_SHA256
*ECDHE_RSA_AES_256_GCM_SHA384
*ECDHE_ECDSA_CHACHA20_POLY1305_SHA256
*ECDHE_RSA_CHACHA20_POLY1305_SHA256
*RSA_AES_128_GCM_SHA256
*RSA_AES_256_GCM_SHA384
*ECDHE_ECDSA_AES_128_CBC_SHA256
*ECDHE_ECDSA_AES_256_CBC_SHA384
*ECDHE_RSA_AES_128_CBC_SHA256
*ECDHE_RSA_AES_256_CBC_SHA384
*RSA_AES_128_CBC_SHA256
*RSA_AES_128_CBC_SHA
*RSA_AES_256_CBC_SHA256
*RSA_AES_256_CBC_SHA
*ECDHE_ECDSA_3DES_EDE_CBC_SHA
*ECDHE_RSA_3DES_EDE_CBC_SHA
*RSA_3DES_EDE_CBC_SHA
TIA


--
Kerwin Crawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related
questions.



--
Kerwin Crawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.




As an Amazon Associate we earn from qualifying purchases.

This thread ...
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.