Reference Manual

10.5
- 10.5.6
- 10.5.5
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5.1
- 10.4.1
- 10.4.0 HotFix 1
- 10.4.0

Back Next

SSL_CIPHER_LIST Statement

The SS_CIPHER_LIST statement restricts the available cipher suites that a Linux, UNIX, or Windows client offers to a server during an SSL handshake to the specified list.

Linux, UNIX, and Windows and IBM i

SSL, SSL_ALLOW_SELFSIGNED, SSL_CONTEXT_METHOD, SSL_REQ_CLNT_CERT, SSL_REQ_SRVR_CERT, and SSL_TOLERATE_UNTRUSTED_ISSUER

SSL_CIPHER_LIST=cipher_list

For the cipher_list variable, specify one or more OpenSSL cipher suite names, separated by commas.

The following table is a partial list of OpenSSL cipher suite names and the corresponding AT-TLS cipher suite names and hexadecimal values:

OpenSSL Cipher Suite Name	AT-TLS Cipher Suite Name	Hexadecimal Value
DHE-RSA-AES256-SHA	TLS_DHE_RSA_WITH_AES_256_CBC_SHA	39
DHE-DSS-AES256-SHA	TLS_DHE_DSS_WITH_AES_256_CBC_SHA	38
AES256-SHA	TLS_RSA_WITH_AES_256_CBC_SHA	35
EDH-RSA-DES-CBC3-SHA	TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA	16
EDH-DSS-DES-CBC3-SHA	TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA	13
DES-CBC3-SHA	TLS_RSA_WITH_3DES_EDE_CBC_SHA	0A
DHE-RSA-AES128-SHA	TLS_DHE_RSA_WITH_AES_128_CBC_SHA	33
DHE-DSS-AES128-SHA	TLS_DHE_DSS_WITH_AES_128_CBC_SHA	32
AES128-SHA	TLS_RSA_WITH_AES_128_CBC_SHA	2F

For a complete list of the cipher suites that are available in the OpenSSL cryptographic library on your Linux, UNIX, or Windows client machine, run the REPORT_CIPHERS command of the PWXUSSL utility.

You might include the SSL_CIPHER_LIST statement in the DBMOVER file on the client machine for any of the following reasons:

To ensure that a Linux, UNIX, or Windows PowerExchange server never uses a weak cipher from a client machine.

To force the use of a preferred cipher from a Linux, UNIX, or Windows client machine rather than having to change a TTLSCipherParms configuration statement on the z/OS server machine.

To avoid the use a the Diffie-Hellman cipher on z/OS because of the slow connection time.

To force the use of a weaker cipher, or a cipher with hardware assistance on z/OS, for faster performance.

Rename Saved Search

Table of Contents

Reference Manual

Reference Manual

SSL_CIPHER_LIST Statement

SSL_CIPHER_LIST Statement