Configuring the TLS 1.2 signature and hash algorithm restriction

Edit online

Configure the TLS 1.2 signature and hash algorithm restrictions on a server to restrict communication to the TLS 1.2 protocol and certificates that meet the specified criteria.

Before you begin

Create a key database file and certificate for secure communications.

For more information, see the Key database, Certificate, and Certificate request chapters in the GSKit tool gsk9certutil_64 user guide GSK9_CertUtil_User_Guide../v11/documents/GSK_CertUtil_UserGuide.pdf.

Set the required permissions (rwx) on the key database file, certificate, and file path for the directory server instance owner.

Procedure

  1. Log in as the instance owner.
  2. To configure a server for secure communication and to set the TLS 1.2 ciphers, run the idsldapmodify command. 
    idsldapmodify -h host_name -p port -D adminDN -w adminPWD -i sign_config.ldif
    The sign_config.ldif file contains the following entries:
    dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslAuth
ibm-slapdSslAuth: serverClientAuth

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSecurity
ibm-slapdSecurity: SSL

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslKeyDatabase
ibm-slapdSslKeyDatabase: /home/dsrdbm01/keys/serverkey.kdb

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslCertificate
ibm-slapdSslCertificate: serverlabel

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslKeyDatabasepw
ibm-slapdSslKeyDatabasepw: keyfilePWD

dn: cn=SSL,cn=Configuration
changetype: modify
add: ibm-slapdSslCipherSpec
ibm-slapdSslCipherSpec: TLS_RSA_WITH_AES_256_CBC_SHA256

dn: cn=SSL,cn=Configuration
changetype: modify
add: ibm-slapdSslCipherSpec
ibm-slapdSslCipherSpec: TLS_RSA_WITH_AES_256_GCM_SHA384
  3. To set the TLS 1.2 protocol on the server, run the idsldapmodify command. 
      idsldapmodify -h host_name -p port -D adminDN -w adminPWD 
  dn: cn=SSL,cn=Configuration 
  changetype: modify 
  add: ibm-slapdSecurityProtocol 
  ibm-slapdSecurityProtocol: TLS12
  4. To set the TLS 1.2 signature and hash algorithm restrictions, run the idsldapmodify command. 
      idsldapmodify -h host_name -p port -D adminDN -w adminPWD 
  dn: cn=SSL,cn=Configuration 
  changetype: modify 
  add: ibm-slapdSSLExtSigalg 
  ibm-slapdSSLExtSigalg: GSK_TLS_SIGALG_RSA_WITH_SHA256
  -
  add: ibm-slapdSSLExtSigalg 
  ibm-slapdSSLExtSigalg:GSK_TLS_SIGALG_RSA_WITH_SHA384
  5. Restart the directory server and administration server. 
    ibmslapd -I dsrdbm01 -k
ibmdiradm -I dsrdbm01 -k
ibmslapd -I dsrdbm01 -n
ibmdiradm -I dsrdbm01

Examples

Example 1
To verify whether the TLS 1.2 signature and hash algorithms are set, run the idsldapsearch command for the root DSE result.
Run a root DSE search against the directory server:
idsldapsearch -p port -s base -b "" objectclass =* ibm-slapdSSLExtSigalg

ibm-slapdSSLExtSigalg=GSK_TLS_SIGALG_RSA_WITH_SHA256,
GSK_TLS_SIGALG_RSA_WITH_SHA384
Run a root DSE search against the administration server
idsldapsearch -p admin_port -s base -b "" objectclass =* 
 admindaemon-sslextsigalg

admindaemon-sslextsigalg=GSK_TLS_SIGALG_RSA_WITH_SHA256,
GSK_TLS_SIGALG_RSA_WITH_SHA384