Changing SSL cipher list -- MIDRANGE-L

Subject: Changing SSL cipher list
From: Justin Taylor <JUSTIN@xxxxxxxxxxxxx>
Date: Thu, 22 Aug 2019 16:11:07 +0000
List-archive: <https://archive.midrange.com/midrange-l/>
List-help: <mailto:midrange-l-request@lists.midrange.com?subject=help>
List-id: Midrange Systems Technical Discussion <midrange-l.lists.midrange.com>
List-post: <mailto:midrange-l@lists.midrange.com>
List-subscribe: <https://lists.midrange.com/mailman/listinfo/midrange-l>, <mailto:midrange-l-request@lists.midrange.com?subject=subscribe>
List-unsubscribe: <https://lists.midrange.com/mailman/options/midrange-l>, <mailto:midrange-l-request@lists.midrange.com?subject=unsubscribe>

I'm having an SSL issue, and IBM support says I need to add one or more of the following ciphers:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

IBM support gave me a doc (https://www-01.ibm.com/support/docview.wss?uid=nas8N1020876) on this. Is it just a simple matter of adding those ciphers to the QSSLCSL system value? Any gotchas I need to watch out for?

That same doc recommends removing weak ciphers. Is there anything I should check before removing them from QSSLCSL?

TIA

As an Amazon Associate we earn from qualifying purchases.

Follow-Ups:

RE: Changing SSL cipher list , Rob Berendt
RE: Changing SSL cipher list , Rob Berendt

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.