Server IDentity on IS servers

,
1

Hi ,

As part of SHA-1 to SHA-2 migration , we have 2 partners SHA-1 complaint and one partner is SHA-2 complaint.

So I have SHA-1 and SHA_2 JKS file. Now SHA_1 used partners are using same port and SHA-2 used partner is using same port. I can give SHA-1 and SHA-2 JKS file at port level. But how it authenticates at run time ? and what should I give as IS server identity SHA-1 or SHA-2 ? we communicate with partners for both incoming and outgoing. Please suggest.

2

If you configure SHA1 and SHA2 keystore and assigned the same HTTPS port it wont work as you might need to decide SHA2 or SHA2 unless you have 2 different URL’s/ports to support SHA1 and SHA2 based transmissions.

HTH,
RMG

3

We have different ports and urls for SHA-1 and SHA-2 partners. But what should we give for IS identitity (IS certificates section) will it SHA-1 or SHA-2 ?

Just to be clear

  1. SHA-1 or SHA-2 can be configured at port level
  2. If some partners are SHA1 and some are on SHA-2 what we should give on IS server identity SHA-1 or SHA-2 ? or it will not matter , only port decides which cert is being used ? Please justify
4
  1. If some partners are SHA1 and some are on SHA-2 what we should give on IS server identity SHA-1 or SHA-2 ? or it will not matter , only port decides which cert is being used ?–>

I believe It will not matter as long as partners and your enterprise handshake with corresponding SHA1/SHA2 certs otherwise transmissions will fail with insufficient security errors or some thing related to the SSL digest.

HTH,
RMG