Re: TLS 1.2 cypher suites on 7.4 with HTTP API

Charles,

I've seen cases where if a server has an obsolete cipher in their list,
even if all others match between the two systems the IBM i will still throw
an error for some reason. I've had to manually add ciphers in for certain
projects because of that... kinda stinks.

Then again, I've also seen clients error out if there is a single expired
CA or cert in the certificate store.. even if it's not used by the
application as well. *shrug*

On Fri, Dec 11, 2020 at 12:25 PM Charles Wilt <charles.wilt@xxxxxxxxx>
wrote:

All,

Trying to figure out what (older?) cypher we need to turn on our 7.4 box.

Here's what's supported at the server (according to
https://www.ssllabs.com/ssltest)

Cipher Suites
# TLS 1.2 (server has no preference)
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) WEAK 112
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK 128
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) WEAK 128
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) WEAK 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK 256
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) WEAK 256
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d) WEAK 256

Currently enabled via *OPSYS is showing
*AES_128_GCM_SHA256
*AES_256_GCM_SHA384
*CHACHA20_POLY1305_SHA256
*ECDHE_ECDSA_AES_128_GCM_SHA256
*ECDHE_ECDSA_AES_256_GCM_SHA384
*ECDHE_RSA_AES_128_GCM_SHA256
*ECDHE_RSA_AES_256_GCM_SHA384
*ECDHE_ECDSA_CHACHA20_POLY1305_SHA256
*ECDHE_RSA_CHACHA20_POLY1305_SHA256

I would have thought that the remote server's
TLS_RSA_WITH_AES_256_GCM_SHA384 would have match the IBM's
*AES_256_GCM_SHA384 but apparently not?

Thanks!
Charles
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.