You can configure the supported ciphers for the protocols
in a client environment for secure communication with a directory
server.
Before you begin
- Install the IBM® Verify Directory,
client package.
- Install GSKit, Version 9.0.0.8.
About this task
Set the LDAP_OPT_SSL_CIPHER variable
to configure ciphers for the SSLv3, TLS 1.0,
or TLS 1.1 protocol. Set the variable with the hexadecimal
values of the ciphers.
Set the LDAP_OPT_SSL_CIPHER_EX variable to configure ciphers for the
TLS 1.2, or TLS 1.3 protocol. Separate the TLS
1.2, or TLS 1.3 ciphers with commas (,), and do not use
spaces.
Procedure
- Access the command line for your operating system.
- Set the ciphers for the required protocols in the client
environment.
Note: If you run the bash shell on a Windows™ system, you can follow the UNIX™ conventions.
- To set ciphers for the
SSLv3, TLS 1.0,
or TLS 1.1 protocol in an LDAP client environment:
- On AIX® and Linux™ operating systems
$export LDAP_OPT_SSL_CIPHER=352F04050A09
- On Windows operating
systems
c:\> set LDAP_OPT_SSL_CIPHER=352F04050A09
- To set ciphers for the
TLS 1.2, or TLS 1.3 protocol in an LDAP
client environment:
- On AIX and Linux
operating systems
-
$export LDAP_OPT_SSL_CIPHER_EX=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH
_AES_256_CBC_SHA384
- On Windows platforms
-
c:\> set LDAP_OPT_SSL_CIPHER_EX=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA
_WITH_AES_256_CBC_SHA384
- Run the client utilities from the same console after you
configure the ciphers.
For example:
export LDAP_OPT_SECURITY_PROTOCOL=SSLV3,TLS10,TLS11,TLS12
export LDAP_OPT_SSL_CIPHER=352F04050A09
export LDAP_OPT_SSL_CIPHER_EX=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA
_WITH_AES_256_CBC_SHA384
idsldapsearch -h server.com -p secure_port -Z -K clientkey.kdb \
-P clientPWD -s base -b "" objectclass =* security
security=ssltls