Thursday, October 13, 2016

Actions required: IBM Traveler on prem, SSL config required from 1 Jan 2017

IBM has published a technote for new required SSL configurations requirements to be implemented  before 1 Jan 2017 to be able to use  IBM Verse mobile app over onprem servers.


  • Server must be configured for HTTPS
  • The server certificate must not be expired or invalid
  • Server certificate CN or SAN must contain the hostname used by mobile apps or must be a wildcard of same domain
  • Connections must be negotiated in TLS 1.2
  • The server certificate must be trusted by mobile apps and either the CA must be trusted or installed on the device
  • The negotiated TLS connections cipher suite must support forward secrecy and must be one of the following :                                                                                                                 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  • The leaf server certificate must be signed with one of the following types of keys RSA  2048 bits or ECC/ECDSA 256 bits
  • The leaf certificate hashing algorithm must be SHA-256 or greater


I think all of this request during 2016/2017 are absolutely resonable but if you haven't payed attention to your IBM Traveler or SSL certiticate during last year you have to check the situation to be sure to be up&running after 1 Jan 2017.

This requirement for example means if you have domino directly exposed over internet must be at least 9.01 FP5 and the Android devices older than 4.1 will be unsupported because TLS 1.2.
Posted by at
Labels: ,
Location: 40053 Valsamoggia BO, Italy

2 comments:

  1. supportoNovember 11, 2016 at 10:52 AM

    Ciao volevo sapere due info in piu se le sai...
    - come da Q2 delle faq nel link, i certificati self signed son accettati dal momento che vengono installati manualmente sul dispositivo, ma questo che vuol dire che il certificato lo installo tramite verse oppure tramite terze app?
    - se ho dei dispositivi apple configurati come profilo apple questo continuerà a funzionare correttamente senza influenze da parte di questa modifica
    Simone

    ReplyDelete
  2. Matteo BisiNovember 11, 2016 at 11:03 AM

    Ciao da quello che dice Q2 si, puoi continuare ad avere self sigend certificato a patto che questo sia sha256 4096 bits for RSA and 256 for Elliptic Curve. Devi però ovviamente installare certificato e CA in utti i dispositivi aziendali che si collegano perchè questi lo possano considerare trust. Se hai un ambiente MDM sicuramente lo potrai fare da li tramite policy altrimenti è un operazione manuale da effettuare su tutti i dispositivi (che sicuramente costa di piu' che acquistare un certificato SSL singolo host). Le nuove limitazioni vengono imposte dala IBM Verse app quindi presumo che gli apple configurati senza pp non risentano di queste modifiche.

    ReplyDelete

Subscribe to: Post Comments (Atom)