Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have delivered WS client to customer, customer have ordered their certificate... but suddenly I got mail from customer's security auditor where he asking me about things that I don't understand why he is interesting. So I fill unprepared for such story twist.
If I will understand the goal of security auditor than I will understand what he really want. He is asking about 1) what is the minimal protocol level that supports WS (SSLv2 or SSLv3) requirement? 2) what is the minimal length of the key 128 or 256 bits?
I have heard about SSL rollback attack but this should be interesting for WS admin (third party), not for WS client network security auditor (my client)... Why WS client's user could be interesting in those things? May be there are firewall settings that he should adjust?