Client utilities and TLS 1.2 signature and hash algorithms

Edit online

You can restrict the communication between a client utility and a server to use the supported TLS 1.2 signature and hash algorithms with the TLS 1.2 protocol. You must set the client environment for secure communications with the TLS 1.2 protocol.

When you set TLS 1.2 signature and hash algorithms, the client verifies the server certificates in a chain for compliance. If the server certificate does not meet the restrictions, the communication fails. After you configure the TLS 1.2 signature and hash algorithms, you must bind to the secure port of a directory server from a client utility for secure communications.

The following TLS 1.2 signature and hash algorithms are supported:

GSK_TLS_SIGALG_RSA_WITH_SHA224
GSK_TLS_SIGALG_RSA_WITH_SHA256
GSK_TLS_SIGALG_RSA_WITH_SHA384
GSK_TLS_SIGALG_RSA_WITH_SHA512
GSK_TLS_SIGALG_ECDSA_WITH_SHA224
GSK_TLS_SIGALG_ECDSA_WITH_SHA256
GSK_TLS_SIGALG_ECDSA_WITH_SHA384
GSK_TLS_SIGALG_ECDSA_WITH_SHA512

Setting the TLS 1.2 signature and hash algorithms in an LDAP client environment

To set the TLS 1.2 signature and hash algorithms in an LDAP client environment, you must set the LDAP_OPT_SSL_EXTN_SIGALG variable with the appropriate values.

To use multiple TLS 1.2 signature and hash algorithm, you must:

  • Separate the values with commas (,).
  • Do not use spaces. Space might cause the client environment to be configured incorrectly.

If the variable is set with an invalid value, the communication with the server might fail.

Note: You must set the LDAP_OPT_SECURITY_PROTOCOL variable with the TLS12 value in the client environment.