Check current TLS protocol version and certificates (XCOM z/OS 3.2 Product Advisory)

Products

• XCOM Data Transport - z/OS
• XCOM Data Transport

Issue/Introduction

Upgrading z/OS to version 3.2.
The XCOM for z/OS Product advisory for XCOM customers to recommend using TLSv1.2 protocol describes changes that IBM are making in z/OS 3.2.
For secure transfers the advisory recommends at a minimum to use the TLS 1.2 protocol version and certificates signed with SHA-256 or higher (without DSA).
How can the current TLS protocol version and certificates used in XCOM be checked?

Environment

XCOM™ Data Transport® for z/OS 12.0 under z/OS 3.2

Resolution

To check TLS protocol version and certificates being used by XCOM the following steps can be used.

The following assumes AT-TLS and/or System SSL is being used (rather than OpenSSL which is longer supported under z/OS)

 

1. AT-TLS:
   Check CONFIG member parameter AT-TLS as per doc page XCOM™ Data Transport® for z/OS 12.0 > Administrating > CONFIG Member Parameters.
   If set to NONE then AT-TLS is not being used.
   If set to one of the other values then AT-TLS is being and need to check with security team on the AT-TLS PAGENT file settings for TLS protocol version and the certificates used in the referenced keystores.
   
   
2. System SSL
   Check CONFIG member parameters under XCOM™ Data Transport® for z/OS 12.0 > Administrating > CONFIG Member Parameters:
   
   
   1. The parameter SSL_VERSION should be set to SYSTEM but if it is not it will automatically be set to that value, per its doc. page.
      
      
   2. The parameter XCOM_CONFIG_SSL points to the SSL configuration file SysConfigSSL.cnf file being used.
      Not all supported parameters are included in the default version of the file.
      Useful article with all supported SysConfigSSL.cnf parameters: Converting XCOM OpenSSL configuration files to System SSL
      Also see doc. page XCOM™ Data Transport® for z/OS 12.0 > Installing > Complete Configuration Tasks > Implement SSL/TLS.
      Specific things to check:
      If parameter SSL_METHOD exists in that file it will indicate if XCOM is setting any restrictions for TLS protocol version usage or that is all handled by the System SSL configuration. 
      Also check the optional CIPHER parameter for any restrictions.
      Again the security team would need to advise on the System SSL configured TLS protocol versions and the certificates being used in the keyring file.

Additional Information

• The XCOM started task XCOMLOG will contain the CONFIG member parameters at the top.
  
  
• XCOM Data Transport for z/OS Compatibility Matrix and section "z/OS Compatibility Matrix"
  
  
• Also see doc. page XCOM™ Data Transport® for z/OS 12.0 > Release Notes > New Features
  
  
• To use the higher TLS protocol version 1.3 requires implementing AT-TLS because XCOM only supports System SSL up to version 1.2. For further details see XCOM™ Data Transport® for z/OS 12.0 > Administrating > Review Administration Best Practices > SSL/TLS Usage