TLS 1.2 signature and hash algorithms

Edit online

You can use the TLS 1.2 signature and hash algorithms to restrict communication to the TLS 1.2 protocol and certificates that meet the signature and hash algorithm criteria.

When you set the TLS 1.2 signature and hash algorithm restrictions, the server verifies the client certificates in a chain for compliance with the specified settings. If the client certificate does not meet the set restrictions, the communication fails.

To use IBM® Security Verify Directory with TLS 1.2 signature and hash algorithm restrictions, you must:

Install GSKit, Version 8.0.55.31.
Configure the server to accept connections on a secure port. Set the ibm-slapdSecurity attribute to SSL, SSLOnly, or SSLTLS.
Configure the server for communications over secure port with the TLS 1.2 protocol.
Configure the required TLS 1.2 ciphers.
Add the ibm-slapdSSLExtSigalg attribute with the appropriate values under the cn=SSL, cn=Configuration entry in the configuration file. To set more than one TLS 1.2 signature and hash algorithm value, you must add multiple entries of the ibm-slapdSSLExtSigalg attribute in the configuration file. If the attribute value is not a valid TLS 1.2 signature and hash algorithm, then the server generates an error and starts in configuration only mode.

The following TLS 1.2 signature and hash algorithms are supported:

GSK_TLS_SIGALG_RSA_WITH_SHA224
GSK_TLS_SIGALG_RSA_WITH_SHA256
GSK_TLS_SIGALG_RSA_WITH_SHA384
GSK_TLS_SIGALG_RSA_WITH_SHA512
GSK_TLS_SIGALG_ECDSA_WITH_SHA224
GSK_TLS_SIGALG_ECDSA_WITH_SHA256
GSK_TLS_SIGALG_ECDSA_WITH_SHA384
GSK_TLS_SIGALG_ECDSA_WITH_SHA512

After you configure a directory server with TLS 1.2 signature and hash algorithms, run a root DSE search against the directory server and administration server to verify the settings.

Server Value in the root DSE result

Directory server

Table 1. Root DSE search result with the `TLS 1.2` signature and hash algorithms that are set on a directory server and an administration server
The table shows the root DSE search result with the `TLS 1.2` signature and hash algorithms that are set on a directory server and an administration server.
Server	Value in the root DSE result
Directory server	`ibm-slapdSSLExtSigalg=GSK_TLS_SIGALG_RSA_WITH_SHA224, GSK_TLS_SIGALG_RSA_WITH_SHA256,GSK_TLS_SIGALG_RSA_WITH_SHA384, GSK_TLS_SIGALG_RSA_WITH_SHA512,GSK_TLS_SIGALG_ECDSA_WITH_SHA224, GSK_TLS_SIGALG_ECDSA_WITH_SHA256,GSK_TLS_SIGALG_ECDSA_WITH_SHA384, GSK_TLS_SIGALG_ECDSA_WITH_SHA512`
Administration server	`admindaemon-sslextsigalg=GSK_TLS_SIGALG_RSA_WITH_SHA224, GSK_TLS_SIGALG_RSA_WITH_SHA256,GSK_TLS_SIGALG_RSA_WITH_SHA384, GSK_TLS_SIGALG_RSA_WITH_SHA512,GSK_TLS_SIGALG_ECDSA_WITH_SHA224, GSK_TLS_SIGALG_ECDSA_WITH_SHA256,GSK_TLS_SIGALG_ECDSA_WITH_SHA384, GSK_TLS_SIGALG_ECDSA_WITH_SHA512`

ibm-slapdSSLExtSigalg=GSK_TLS_SIGALG_RSA_WITH_SHA224,
GSK_TLS_SIGALG_RSA_WITH_SHA256,GSK_TLS_SIGALG_RSA_WITH_SHA384,
GSK_TLS_SIGALG_RSA_WITH_SHA512,GSK_TLS_SIGALG_ECDSA_WITH_SHA224,
GSK_TLS_SIGALG_ECDSA_WITH_SHA256,GSK_TLS_SIGALG_ECDSA_WITH_SHA384,
GSK_TLS_SIGALG_ECDSA_WITH_SHA512

Administration server

admindaemon-sslextsigalg=GSK_TLS_SIGALG_RSA_WITH_SHA224,
GSK_TLS_SIGALG_RSA_WITH_SHA256,GSK_TLS_SIGALG_RSA_WITH_SHA384,
GSK_TLS_SIGALG_RSA_WITH_SHA512,GSK_TLS_SIGALG_ECDSA_WITH_SHA224,
GSK_TLS_SIGALG_ECDSA_WITH_SHA256,GSK_TLS_SIGALG_ECDSA_WITH_SHA384,
GSK_TLS_SIGALG_ECDSA_WITH_SHA512

Note:

When you configure a server with the TLS 1.2 signature and hash algorithm restrictions, the server listens only on the secure port.
If a server is not configured to communicate with the TLS 1.2 protocol, the ibm-slapdSSLExtSigalg attribute in the configuration file is ignored. The server uses the existing settings.