Configuring ciphers in a client environment

You can configure the supported ciphers for the protocols in a client environment for secure communication with a directory server.

Before you begin

  • Install the IBM® Verify Directory, client package.
  • Install GSKit, Version 9.0.0.8.

About this task

Set the LDAP_OPT_SSL_CIPHER variable to configure ciphers for the SSLv3, TLS 1.0, or TLS 1.1 protocol. Set the variable with the hexadecimal values of the ciphers.

Set the LDAP_OPT_SSL_CIPHER_EX variable to configure ciphers for the TLS 1.2, or TLS 1.3 protocol. Separate the TLS 1.2, or TLS 1.3 ciphers with commas (,), and do not use spaces.

Procedure

  1. Access the command line for your operating system.
  2. Set the ciphers for the required protocols in the client environment.
    Note: If you run the bash shell on a Windows™ system, you can follow the UNIX™ conventions.
    • To set ciphers for the SSLv3, TLS 1.0, or TLS 1.1 protocol in an LDAP client environment:
      On AIX® and Linux™ operating systems
      $export LDAP_OPT_SSL_CIPHER=352F04050A09
      On Windows operating systems
      c:\> set LDAP_OPT_SSL_CIPHER=352F04050A09
    • To set ciphers for the TLS 1.2, or TLS 1.3 protocol in an LDAP client environment:
      On AIX and Linux operating systems
      $export LDAP_OPT_SSL_CIPHER_EX=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH
      _AES_256_CBC_SHA384
                                     
      On Windows platforms
      c:\> set LDAP_OPT_SSL_CIPHER_EX=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA
      _WITH_AES_256_CBC_SHA384
      
  3. Run the client utilities from the same console after you configure the ciphers.
    For example:
    export LDAP_OPT_SECURITY_PROTOCOL=SSLV3,TLS10,TLS11,TLS12
    
    export LDAP_OPT_SSL_CIPHER=352F04050A09
    
    export LDAP_OPT_SSL_CIPHER_EX=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA
    _WITH_AES_256_CBC_SHA384
                                  
    idsldapsearch -h server.com -p secure_port -Z -K clientkey.kdb \
    -P clientPWD -s base -b "" objectclass =* security
    
    security=ssltls