Configuring TLS 1.3 settings in a client environment

You can specify extra settings that are used to establish a TLS 1.3 session in a client environment.

Before you begin

Install the IBM® Security Verify Directory client package.
Install GSKit, Version 8.0.55.31.

A number of extra settings can be used to establish a TLS 1.3 session in a client environment.

Table 1. TLS 1.3 Settings
Environment Variable Name	Description	Possible Values
LDAP_OPT_TLS13_MIDDLE_BOX_MODE	Sets the TLS 1.3 handshake to resemble TLS 1.2 session, which improves the chance of successfully connecting through middle boxes.	ON (Default) OFF
LDAP_OPT_TLS13_SIG_SCHEME	Set the supported signature schemes that can be used to establish a session.	GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA256 GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA384 GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA512 GSK_TLS_SIG_SCHEME_ECDSA_SECP256R1_SHA256 GSK_TLS_SIG_SCHEME_ECDSA_SECP384R1_SHA384 GSK_TLS_SIG_SCHEME_ECDSA_SECP521R1_SHA512 GSK_TLS_SIG_SCHEME_RSA_PSS_RSAE_SHA256 GSK_TLS_SIG_SCHEME_RSA_PSS_RSAE_SHA384 GSK_TLS_SIG_SCHEME_RSA_PSS_RSAE_SHA512 GSK_TLS_SIG_SCHEME_RSA_PSS_PSS_SHA256 GSK_TLS_SIG_SCHEME_RSA_PSS_PSS_SHA384 GSK_TLS_SIG_SCHEME_RSA_PSS_PSS_SHA512 GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA1 GSK_TLS_SIG_SCHEME_ECDSA_SHA1
LDAP_OPT_TLS13_SIG_SCHEME_CERT	Sets the supported signature schemes, applicable for certificates.	GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA256 GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA384 GSK_TLS_SIG_SCHEME_RSA_PKCS1_SHA512 GSK_TLS_SIG_SCHEME_ECDSA_SECP256R1_SHA256 GSK_TLS_SIG_SCHEME_ECDSA_SECP384R1_SHA384 GSK_TLS_SIG_SCHEME_ECDSA_SECP521R1_SHA512 GSK_TLS_SIG_SCHEME_RSA_PSS_RSAE_SHA256 GSK_TLS_SIG_SCHEME_RSA_PSS_RSAE_SHA384 GSK_TLS_SIG_SCHEME_RSA_PSS_RSAE_SHA512 GSK_TLS_SIG_SCHEME_RSA_PSS_PSS_SHA256 GSK_TLS_SIG_SCHEME_RSA_PSS_PSS_SHA384 GSK_TLS_SIG_SCHEME_RSA_PSS_PSS_SHA512
LDAP_OPT_TLS13_KEY_EXCHANGE_GROUPS	Sets the supported named elliptic curve groups for key exchange, ordered from most preferred to least preferred.	GSK_TLS_SUPPORTED_GROUP_ECDHE_X25519 GSK_TLS_SUPPORTED_GROUP_ECDHE_SECP256R1 GSK_TLS_SUPPORTED_GROUP_ECDHE_SECP384R1 GSK_TLS_SUPPORTED_GROUP_ECDHE_SECP521R1 GSK_TLS_SUPPORTED_GROUP_ECDHE_X448

Procedure

Access the command line for your operating system.
Set the appropriate environment variable with the appropriate protocol values.

Note: If you run the bash shell on a Windows™ system, you can follow the UNIX™ conventions.
- For example, to disable the TLS 1.3 middle box mode in an LDAP client environment:
  Platform Run this command:
  AIX® and Linux™
  $export LDAP_OPT_TLS13_MIDDLE_BOX_MODE=OFF
  
  Windows
  c:\> set LDAP_OPT_TLS13_MIDDLE_BOX_MODE=OFF

Platform	Run this command:
AIX® and Linux™	`$export LDAP_OPT_TLS13_MIDDLE_BOX_MODE=OFF`
Windows	`c:\> set LDAP_OPT_TLS13_MIDDLE_BOX_MODE=OFF`

Run the client utilities from the same console after you configure the TLS 1.3 middle box mode.

For example,

export LDAP_OPT_TLS13_MIDDLE_BOX_MODE=OFF

idsldapsearch -h server.com -p secure_port -Z -K clientkey.kdb \
-P clientPWD -s base -b "" objectclass =* security

security=ssltls