SSL certificate and key management

 

+

Search Tips   |   Advanced Search

 

Use this page to configure security for Secure Socket Layer (SSL) and key management, certificates, and notifications. The SSL protocol provides secure communications between remote server processes or endpoints. SSL security can be used for establishing communications inbound to and outbound from an endpoint. To establish secure communications, a certificate and an SSL configuration must be specified for the endpoint.

To view this console page, click...

Security | SSL certificate and key management

 

Configuration tab

Configuration settings

Following console tasks:

• Manage endpoint security configurations

• Manage certificate expiration

Use FIPS algorithms

Specify the FIPS-compliant Java cryptography engine is enabled.

• Does not affect the SSL cryptography that is performed by the appserver for z/OS System Secure Sockets Layer (SSSL).

• Does not change the JSSE provider if this cell includes any Application Server versions before the appserver for z/OS V6.0.x.

When you select the Use the FIPS option, the LTPA implementation uses IBMJCEFIPS which supports the FIPS-approved cryptographic algorithms for Data Encryption Standard (DES), Triple DES, and Advanced Encryption Standard (AES).

Although the LTPA keys are backwards compatible with prior releases of the appserver, the LTPA token is not compatible with prior releases. In prior releases, the appserver did not generate the LTPA token using a FIPS-approved algorithm.

The IBMJSSE2 JSSE provider does not perform cryptographic functions directly, and therefore does not need to be FIPS-approved. Instead, the IBMJSSE2 JSSE provider uses the JCE framework for cryptographic functions and uses IBMJCEFIPS when FIPS mode is enabled.

The IBMJSSEFIPS provider is not supported on the HP-UX platform. However, the IBMJSSE2 provider, which uses IBMJCEFIPS, is supported on the HP-UX platform.

Default:

Disabled

Dynamically update the runtime when SSL configuration changes occur

Specify that all of the SSL-related attributes that change must be read from the configuration dynamically after they have been saved, then reused for new connections. To avoid customer impact, it is recommended that changes to production servers be made during off-peak periods.

Default:

Disabled

When this option is selected, the configuration is updated each time you configure an SSL communication.

---

 

Related tasks

Creating a Secure Sockets Layer configuration

 

Related Reference

Manage endpoint security configurations
Manage certificate expiration settings
Notifications
SSL configurations collection
Dynamic inbound and outbound endpoint SSL configurations collection
Key stores and certificates collection
Key sets collection
Key set groups collection
Key managers collection
Trust managers collection

 

Reference topic