Re: SSL Cipher Support and V7R1... and so it begins

[DrFranken <midrange@xxxxxxxxxxxx>]

And so we are again bitten by the curse of 'it just runs, leave it 
alone'. i 7.1 was a fantastically long lived release and too many 
simply don't want to believe that it could possibly be time to upgrade. 
If their hardware can't go beyond i 7.1 then they are on some seriously 
old stuff, again doesn't mean it doesn't work but wow, that's Power5 
vintage up to 13 years old! Or put another way a disk drive installed in 
that Power5 machine in 2004 would have rotated over 100,000,000,000 
times since then, yes that's 100 Billion!

I would feel sorry for these folks if they didn't get any warnings or 
simply had no alternatives. But they did get warnings, over and over and 
over and they DO have alternatives, from newer used gear to newer 
(FANTASTICALLY FASTER) and smaller gear or cloud (hint hint!)

Also consider if they are in environments with external communications 
and they refuse to update software they are setting themselves up for 
failure, not if simply when.

I do agree with you that IBM isn't going to enhance i 7.1. They have 
already provided two new releases both easy to upgrade to and they 
indicated many months ago that i 7.1 is in fix only mode. As it should be!

        - Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 7/10/2017 9:04 AM, Bradley Stone wrote:
> I believe June or July 2017 was a deadline for financial institutions
> to update their SSL certificates to the latest and greatest.
>
> 3 customers in one week so far have been affected, but only because
> they are on V7R1.  The only option is to update to V7R2 or higher.  2
> out of 3 say they need new hardware to update to a new OS.  So not
> really "free".
>
> I would be on the lookout if you use GETURI, HTTPAPI, or any other
> socket application that uses SSL to communicate with financial
> institutions if you're on V7R1 or lower.  It will most likely stop
> working soon if it hasn't already.
>
> The only other option I can see to do, since IBM won't install the new
> ciphers, is possibly ask them to update the SSL Handshake API to allow
> you to bypass the RC(-1) No Ciphers error (and others like -24
> SSL_ERROR_CERT_EXPIRED which is stupid anyhow) like you can with the
> not trusted handshake error.
>
> Wishful thinking.  :)
>
>
> Bradley V. Stone
> www.bvstools.com
> MAILTOOL Benefit #6: Easily send group emails with Distribution Lists