AT-TLS and System SSL Defaults in z/OS 3.2: What Changed and How to Adapt with XCOM Data Transport
search cancel

AT-TLS and System SSL Defaults in z/OS 3.2: What Changed and How to Adapt with XCOM Data Transport

book

Article ID: 441906

calendar_today

Updated On:

Products

XCOM - SUPPORT XCOM Data Transport XCOM Data Transport - Linux PC XCOM Data Transport - Windows XCOM Data Transport - z/OS

Issue/Introduction

Product advisory for XCOM customers to recommend using TLSv1.2 protocol at a minimum and certificates signed with SHA-256 or higher (without DSA) for secure transfers with z/OS 3.2

Resolution

  • Protocol and Certificate Requirements: It is strongly recommended to use a minimum of the TLSv1.2 protocol for secure transfers, and ensure that certificates are signed with a minimum algorithm of SHA-256, specifically excluding the DSA algorithm.
  • z/OS V3R2 Changes to Default settings (AT-TLS or System SSL):
    • Starting with z/OS V3R2, only TLSv1.2 is enabled by default, unless TLSv1.3 is explicitly enabled.
    • Older protocol versions, including SSLv3, TLSv1, and TLSv1.1, are disabled by default.
    • Transfers will fail on z/OS V3R2 if certificates are signed with any of the following algorithms:
      1. SHA-256 with DSA
      2. SHA-224 with RSA
      3. SHA-224 with ECDSA
      4. SHA-224 with DSA
      5. SHA-1 with RSA
      6. SHA-1 with ECDSA
      7. SHA-1 with DSA

Ref: https://community.ibm.com/community/user/blogs/navya-ramanjulu/2025/11/01/at-tls-and-system-ssl-defaults-in-zos3-2

  • Partner System Compliance: To ensure successful SSL connections, partner systems must also avoid using the disabled protocols (SSLv3, TLSv1, TLSv1.1) and certificates signed with the listed unsupported algorithms.
  • XCOM Sample Script Updates: The sample SSL scripts and configuration files for XCOM Linux and Windows 12.0 have been updated to align with the new IBM z/OS 3.2 SSL/TLS defaults. They now use the SHA-256 message digest algorithm and a 2048-bit RSA key size.
  • Required Maintenance: Customers must download and apply the necessary XCOM maintenance level (or the latest superseding level) to obtain the updated sample SSL scripts and product fixes.

Note: The provided sample SSL scripts are for reference purposes only and are not recommended for use in production environments. Customers must consult their security administrator to obtain proper SSL certificates for configuring secure transfers.

Additional Information

AT-TLS and System SSL Defaults in z/OS 3.2: What Changed and How to Adapt?

Powered by Wolken Software