If you want to stay on 23.1, can you use RH9 or ubuntu22 iris kit? It wont be quite 3.11, but at least it wont be 3.6!
If you are saying that you took a RH8 server and made python3 symbolic link point to a poorly supported development stream of 3.9->3.10->3.11->3.12 I would be very worried if your server was actually going to stay up. Its OK to install a "python3.11" link for experimentation but its not exactly supported like 3.6 would be on RH8.
In general you want to stay with something the OS vendor supports, and this is the way IRIS works as well. IRIS doesn't want to be in the business of telling customers to install a non default python version. IRIS doesn't ship python on UNIX and the quality group will focus the vast majority of its efforts on testing the default python of the OS.
If you must stay on RH8, you can try 24.1 and Flexible... but you would still need a support plan that lasts through deployment. Its not good to rely on a dev stream.
BTW the main iris integration is not with the python3 binary. Its with something called libpython.so, which is an optional component of python. That's what "embedded" means.
--
Philip
To add on to what Bob said, TL1 first release had the wrong SSL3 - it was not usable to compile some common open source packages because of some SSL configuration options. TL1 SP2 had a usable release. 02-2320 means week 20 so it was released in week 20 of the year.
The 7.2 situation is more problematical. To me (just my opinion) it doesn't look like IBM plans to update the default SSL in 7.2 to 3. Instead they offer an optional download from the MRS web site with an up to date SSL3 and some other related components. Its not an ideal sys admin picture. It gets a little worse - lets say you want apache from their toolbox. The toolbox will make you get an SSL bundle from the MRS website.