ssl.client.props client configuration file

ssl.client.props client configuration file

Use the ssl.client.props file to configure SSL for clients. In previous releases of WebSphere Application Server, SSL properties were specified in the sas.client.props or soap.client.props files or as system properties. By consolidating the configurations, WAS enables us to manage security in a manner that is comparable to server-side configuration management. We can configure the ssl.client.props file with multiple SSL configurations.

Set up the SSL configuration for clients

Client runtimes are dependent on the WAS ssl.client.props configurations.

Use setupCmdLine script on the command line to specify the com.ibm.SSL.ConfigURL system property, which references a file URL pointing to the ssl.client.props file. We can reference the CLIENTSSL variable on the command line of any script that uses the setupCmdLine.bat file.

(iSeries) Use the setupCmdLine script on the command line to specify the com.ibm.SSL.ConfigURL system property. The setupclient script also sets the CLIENTSSL variable. The com.ibm.SSL.ConfigURL property references a file URL pointing to the ssl.client.props file. We can reference the CLIENTSSL variable on the command line of any script that uses the setupCmdLine file.

When we specify the com.ibm.SSL.ConfigURL system property, the SSL configuration is available to all protocols that use SSL. SSL configurations, which are referenced in the ssl.client.props file, also have aliases that we can reference. In the following sample code from the sas.client.props file, all of the SSL properties are replaced with a property pointing to an SSL configuration in the ssl.client.props file:
com.ibm.ssl.alias=DefaultSSLSettings

The following sample code shows a property in the soap.client.props file that is similar to the com.ibm.SSL.ConfigURL property. This property references a different SSL configuration on the client side:
com.ibm.ssl.alias=DefaultSSLSettings

In the ssl.client.props file, we can change the administrative SSL configuration to avoid modifying the soap.client.props file.
Tip: Support for SSL properties is still specified in the sas.client.props and soap.client.props files. However, consider moving the SSL configurations to the ssl.client.props file, because this file is the new configuration model for client SSL.
(iSeries) (ZOS) When configuring a client which does not call setupCmdLine.sh to connect to an application server using security, ensure that the following system property is defined on the client configuration:
-Djava.security.properties=profile_root/properties/java.security

Properties of the ssl.client.props file
This section describes the default ssl.client.props file properties in detail, by sections within the file. If we specify javax.net.ssl system properties, these will override the settings in ssl.client.props file.

Global properties:

Global SSL properties are process-specific properties that include Federal Information Processing Standard (FIPS) enablement, the default SSL alias, the user.root property for specifying the root location of the key and truststore paths, and so on.

(iSeries) Global SSL properties are process-specific properties that include Federal Information Processing Standard (FIPS) enablement, the default SSL alias, the profile_root of the profile for specifying the root location of the key and truststore paths, and so on.

Property Default Description
com.ibm.ssl.defaultAlias DefaultSSLSettings Default alias used whenever an alias is not specified by the protocol that calls the JSSEHelper API to retrieve an SSL configuration. This property is the final arbiter on the client side for determining which SSL configuration to use.
com.ibm.ssl.validationEnabled false When true, validate each SSL configuration as it is loaded. Use this property for debug purposes only, to avoid unnecessary performance overhead during production.
com.ibm.ssl.performURLHostNameVerification false When true, enforce URL host name verification. When HTTP URL connections are made to target servers, the common name (CN) from the server certificate must match the target host name. Without a match, the host name verifier rejects the connection. The default value of false omits this check. As a global property, it sets the default host name verifier. Any javax.net.ssl.HttpsURLConnection object can choose to enable host name verification for that specific instance by calling the setHostnameVerifier method with its own HostnameVerifier instance.
This property does not apply to SSL channels.
com.ibm.security.useFIPS false When true, FIPS-compliant algorithms are used for SSL and other Java Cryptography Extension (JCE)-specific applications. This property is typically not enabled unless the property is required by the operating environment.
com.ibm.websphere.security.FIPSLevel false Level of the security standard to use. Valid values include 140-2, SP800-131 and transition. The com.ibm.security.useFIPS property must be set to true to enable suite B. The property must be entered in the ssl.client.props file in the global properties section, preferably after com.ibm.security.useFIPS.
com.ibm.websphere.security.suiteB false Level of Suite B security standard to enable. Valid values include 128 and 192. To enable the com.ibm.security.useFIPS property. it must be set to true. The property must be entered in the ssl.client.props file in the global properties section, preferably after com.ibm.security.useFIPS.
(ZOS) user.root (ZOS) ${WASROOT} (ZOS) This property can be used by key and truststore location properties as a single property for specifying the root path to the key and truststores. ${WASROOT} is the root directory of the current profile. Typically, this property is the profile root. However, we can modify this property to any root directory on the local machine that has the proper read and potentially write authority to that directory.

Certificate creation properties:

Use certificate creation properties to specify the default self-signed certificate values for the major attributes of a certificate. We can define the distinguished name (DN), expiration date, key size, and alias stored in the keystore.

Property Default Description
com.ibm.ssl.defaultCertReqAlias default_alias Default alias to use to reference the self-signed certificate created in the keystore. If the alias already exists with that name, the default alias is appended with _#, where the number sign (#) is an integer that starts with 1 and increments until it finds a unique alias.
com.ibm.ssl.defaultCertReqSubjectDN cn=${hostname}, o=IBM,c=US Use the property distinguished name (DN) that we set for the certificate when it is created. The ${hostname} variable is expanded to the host name on which it resides. Use correctly formed DNs as specified by the X.509 certificate.
com.ibm.ssl.defaultCertReqDays 365 Validity period for the certificate and can be as small as 1 day and as large as the maximum number of days that a certificate can be set, which is approximately 15 years.
com.ibm.ssl.defaultCertReqKeySize 1024 Default key size. The valid values depend upon the Java Virtual Machine (JVM) security policy files installed. By default, the product JVMs ship with the export policy file that limits the key size to 1024. To get a large key size such as 2048, we can download the restricted policy files from the website.

Certificate revocation checking:
To enable certificate revocation checking, we can set a combination of Online Certificate Status Protocol (OCSP) properties. These properties are not used unless we set the com.ibm.ssl.trustManager property to IbmPKIX. In addition, to successfully process revocation checking on the client, we must turn off the signer exchange prompt. To turn off the signer exchange prompt, change the com.ibm.ssl.enableSignerExchangePrompt property to false. See documentation on Enabling certificate revocation checking with the default IbmPKIX trust manager.

SSL configuration properties:
Use the SSL configuration properties section to set multiple SSL configurations. For a new SSL configuration specification, set the com.ibm.ssl.alias property because the parser starts a new SSL configuration with this alias name. The SSL configuration is referenced using the alias property from another file, such as sas.client.props or soap.client.props, through the default alias property. The properties specified in the following table allow us to create a javax.net.ssl.SSLContext, among other SSL objects.

Property Default Description
com.ibm.ssl.alias DefaultSSLSettings Name of this SSL configuration. Must be the first property for an SSL configuration because it references the SSL configuration. If we change the name of this property after it is referenced elsewhere in the configuration, the runtime defaults to the com.ibm.ssl.defaultAlias property whenever the reference is not found. The error trust file is null or key file is null might display when we start an application using an SSL reference that is no longer valid.
com.ibm.ssl.protocol SSL_TLS SSL handshake protocol used for this SSL configuration. This property attempts Transport Layer Security (TLS) first, but accepts any remote handshake protocol, including SSLv3 and TLSv1. Valid values for this property include SSL_TLS, SSL, SSLv2 (client side only), SSLv3, TLS, TLSv1, SSL_TLSv2, TLSv1.1, and TLSv1.2.
com.ibm.ssl.securityLevel STRONG Cipher group used for the SSL handshake. The typical selection is STRONG, which specifies 128-bit or higher ciphers. The MEDIUM selection provides 40-bit ciphers. The WEAK selection provides ciphers that do not perform encryption, but do perform signing for data integrity. If we specify our own cipher list selection, uncomment the property com.ibm.ssl.enabledCipherSuites.
The use of javax.net.ssl system properties causes this value to always be HIGH.
com.ibm.ssl.trustManager IbmX509 Default trust manager that we must use to validate the certificate sent by the target server. This trust manager does not perform certificate revocation list (CRL) checking. We can choose to change this value to IbmPKIX for CRL checking using CRL distribution lists in the certificate, which is a standard way to perform CRL checking. When we want to perform custom CRL checking, we must implement a custom trust manager and specify the trust manager in the com.ibm.ssl.customTrustManagers property. The IbmPKIX option might affect performance because this option requires IBMCertPath for trust validation. Use IbmX509 unless CRL checking is necessary. If we are using the Online Certificate Status Protocol (OCSP) properties, set this property value to IbmPKIX.
com.ibm.ssl.keyManager IbmX509 Default key manager to use for choosing the client alias from the specified keystore. This key manager uses the com.ibm.ssl.keyStoreClientAlias property to specify the keystore alias. If not specified, the choice is delegated to JSSE. JSSE typically chooses the first alias that it finds.
com.ibm.ssl.contextProvider IBMJSSE2 Choose the JSSE provider for the SSL context creation. IBM recommends defaulting to IBMJSSE2 when we use a Java virtual machine (JVM). The client plug-in can use the SunJSSE provider when using a Sun JVM.
com.ibm.ssl.enableSignerExchangePrompt true This property determines whether to display the signer exchange prompt when a signer is not present in the client truststore. The prompt displays information about the remote certificate so that WAS can decide whether or not to trust the signer. It is very important to validate the certificate signature. This signature is the only reliable information that can guarantee that the certificate has not been modified from the original server certificate. For automated scenarios, disable this property to avoid SSL handshake exceptions. Run the retrieveSigners script, which sets up the SSL signer exchange, to download the signers from the server prior to running the client. If we are using the Online Certificate Status Protocol (OCSP) properties, set this property value to false.
com.ibm.ssl.keyStoreClientAlias default Reference an alias from the specified keystore when the target does not request client authentication. When WAS creates a self-signed certificate for the SSL configuration, this property determines the alias and overrides the global com.ibm.ssl.defaultCertReqAlias property.
com.ibm.ssl.customTrustManagers Commented out by default Enable specification of one or more custom trust managers, which are separated by commas. These trust managers can be in the form of algorithm|provider or classname. For example, IbmX509|IBMJSSE2 is in the algorithm|provider format, and the com.acme.myCustomTrustManager interface is in the classname format. The class must implement the javax.net.ssl.X509TrustManager interface. Optionally, the class can implement the com.ibm.wsspi.ssl.TrustManagerExtendedInfo interface. These trust managers run in addition to the default trust manager specified by the com.ibm.ssl.trustManager interface. These trust managers do not replace the default trust manager.
com.ibm.ssl.customKeyManager Commented out by default Enable you to have one, and only one, custom key manager. The key manager replaces the default key manager specified in the com.ibm.ssl.keyManager property. The form of the key manager is algorithm|provider or classname. See the format examples for the com.ibm.ssl.customTrustManagers property. The class must implement the javax.net.ssl.X509KeyManager interface. Optionally, the class can implement the com.ibm.wsspi.ssl.KeyManagerExtendedInfo interface. This key manager is responsible for alias selection.
com.ibm.ssl.dynamicSelectionInfo Commented out by default Enable dynamic association with the SSL configuration. The syntax for a dynamic association is outbound_protocol, target_host, or target_port. For multiple specifications, use the vertical bar ( | ) as the delimiter. We can replace any of these values with an asterisk (*) to indicate a wildcard value. Valid outbound_protocol values include: IIOP, HTTP, LDAP, SIP, BUS_CLIENT, BUS_TO_WEBSPHERE_MQ, BUS_TO_BUS, and ADMIN_SOAP. When we want the dynamic selection criteria to choose the SSL configuration, uncomment the default property, and add the connection information. For example, add the following on one line
com.ibm.ssl.dynamicSelectionInfo=HTTP,.ibm.com,443|HTTP,.ibm.com,9443

com.ibm.ssl.enabledCipherSuites Commented out by default Specify a custom cipher suite list and override the group selection in the com.ibm.ssl.securityLevel property. The valid list of ciphers varies according to the provider and JVM policy files that are applied. For cipher suites, use a space as the delimiter.
com.ibm.ssl.keyStoreName ClientDefaultKeyStore Keystore configuration name. If we have not already defined the keystore, the rest of the keystore properties must follow this property. After defining the keystore, we can specify this property to reference the previously specified keystore configuration. New keystore configurations in the ssl.client.props file have a unique name.
com.ibm.ssl.trustStoreName ClientDefaultTrustStore This property references a truststore configuration name. If we have not already defined the truststore, the rest of the truststore properties must follow this property. After defining the truststore, we can specify this property to reference the previously specified truststore configuration. New truststore configurations in the ssl.client.props file should have a unique name.

(ZOS) The default values of keystore and truststore configuration properties depend on the security configuration that we select on the Administrative Security Selection panel of the z/OS Profile Management Tool. The following options are available on the Administrative Security Selection panel:

If we indicate the Use a z/OS security product option, which is the first option, the default values for the keystore and truststore configuration properties point to a keystore with a JCERACFKS type. This type uses keys and certificates stored and managed by a z/OS security product such as RACF . See "z/OS keystores" section in the "Keystore configurations" topic.
If we indicate the Use WAS security option, which is the second option, or the Do not enable security option, which is the third option, the default values for the keystore and truststore configuration properties point to a keystore with a PKCS12 file. For more information on file-based keystores, see the "IBMJCE file-based keystores (JCEKS, JKS, and PKCS12)" section in the "Keystore configurations" topic.

Keystore configurations:
SSL configurations reference keystore configurations whose purpose is to identify the location of certificates. Certificates represent the identity of clients that use the SSL configuration. We can specify keystore configurations with other SSL configuration properties. However, IBM recommends specifying the keystore configurations in this section of the ssl.client.props file after the com.ibm.ssl.keyStoreName property identifies the start of a new keystore configuration. After fully defining the keystore configuration, the com.ibm.ssl.keyStoreName property can reference the keystore configuration at any other point in the file.

Property Default Description
com.ibm.ssl.keyStoreName ClientDefaultKeyStore Name of the keystore as it is referenced by the runtime. Other SSL configurations can reference this name further down in the ssl.client.props file to avoid duplication.
com.ibm.ssl.keyStore ${user.root}/etc/key.p12 Location of the keystore in the required format of the com.ibm.ssl.keyStoreType property. Typically, this property references a keystore file name. However, for cryptographic token types, this property references a Dynamic Link Library (DLL) file.
If we are using a 4764 cryptography card, then the keystore file name for the client configuration should be specified as the file 4764.cfg in a directory structure of our choice, and the corresponding com.ibm.ssl.keyStoreType should be set to PKCS11. The 4764.cfg file is NOT supplied with WAS.
com.ibm.ssl.keyStorePassword WebAS Default password, which is the cell name for the profile when it is created. The password is typically encoded using an {xor} algorithm. Use iKeyman to change the password in the keystore, then change this reference. If we do not know the password and if the certificate is created for you, change the password in this property, then delete the keystore from the location where it resides. Restart the client to recreate the keystore using the new password, but only if the keystore name ends with DefaultKeyStore and if the fileBased property is true. Delete both the keystore and truststore at the same time so that a proper signer exchange can occur when both are recreated together.
com.ibm.ssl.keyStoreType PKCS12 Keystore type. Use the default, PKCS12, because of its interoperability with other applications. Specify this property as any valid keystore type supported by the JVM on the provider list.
com.ibm.ssl.keyStoreProvider IBMJCE The IBM Java Cryptography Extension property is the keystore provider for the keystore type. The provider is typically IBMJCE or IBMPKCS11Impl for cryptographic devices.
com.ibm.ssl.keyStoreFileBased true This property indicates to the runtime that the keystore is file-based, meaning it is located on the file system.
com.ibm.ssl.keyStoreReadOnly false This property indicates to the run time for WAS whether the key store can be modified during the run time.

(ZOS) In the following table, the values in the "Default values for a z/OS security product" column correspond to the default values used when the Use a z/OS security product option is indicated on the Administrative Security Selection panel of the z/OS Profile Management Tool. This option is the first option on the Administrative Security Selection panel. The values in the "Default values for WAS security" column correspond to the default values used with the Use WAS option is indicated on the Administrative Security Selection panel of the z/OS Profile Management Tool. This option is second option on the Administrative Security Selection panel.

(ZOS)

Property Default values for a z/OS security product Default values for WAS security Description
com.ibm.ssl.keyStoreName ClientDefaultKeyStore ClientDefaultKeyStore Name of the keystore as it is referenced by the runtime. Other SSL configurations can reference this name further down in the ssl.client.props file to avoid duplication.
com.ibm.ssl.keyStore
safreyring:///your_keyring

This value is set on the SSL Customization panel of the z/OS Profile Management Tool.
${user.root}/etc/key.p12 Location of the keystore in the required format of the com.ibm.ssl.keyStoreType property. Typically, this property references a keystore file name. However, for cryptographic token types, this property references a Dynamic Link Library (DLL) file.
com.ibm.ssl.keyStorePassword password WebAS Default password, which is the cell name for the profile when it is created. The password is typically encoded using an {xor} algorithm. Use iKeyman to change the password in the keystore, then change this reference. If we do not know the password and if the certificate is created for you, change the password in this property, then delete the keystore from the location where it resides. Restart the client to recreate the keystore using the new password, but only if the keystore name ends with DefaultKeyStore and if the fileBased property is true. Delete both the keystore and truststore at the same time so that a proper signer exchange can occur when both are recreated together.
com.ibm.ssl.keyStoreType JCERACFKS PKCS12 Keystore type. Use the default, PKCS12, because of its interoperability with other applications. Specify this property as any valid keystore type supported by the JVM on the provider list. The type can be JCERACFKS, JCECCARACFKS, or JCECCAKS for cryptographic devices.
com.ibm.ssl.keyStoreProvider IBMJCE IBMJCE The IBM Java Cryptography Extension property is the keystore provider for the keystore type. The provider is typically IBMJCE or IBMPKCS11Impl for cryptographic devices.
com.ibm.ssl.keyStoreFileBased false true This property indicates to the runtime that the keystore is file-based, meaning it is located on the file system.
com.ibm.ssl.keyStoreReadOnly true false This property indicates to the run time for WAS whether the keystore can be modified during the run time. For example, we cannot modify read-only key stores using the Administrative Console or through scripting. SAF Keyrings, which are used by WAS for z/OS, are always read-only.

Truststore Configurations

SSL configurations reference truststore configurations, whose purpose is to contain the signer certificates for servers trusted by this client. We can specify these properties with other SSL configuration properties. However, IBM recommends specified truststore configurations in this section of the ssl.client.props file after the com.ibm.ssl.trustStoreName property has identified the start of a new truststore configuration. After fully defining the truststore configuration, the com.ibm.ssl.trustStoreName property can reference the configuration at any other point in the file.

A truststore is a keystore that JSSE uses for trust evaluation. A truststore contains the signers that WAS requires before it can trust the remote connection during the handshake. If we configure the property...
com.ibm.ssl.trustStoreName=ClientDefaultKeyStore

...we can reference the keystore as the truststore. Further configuration is not required for the truststore because all of the signers generated through signer exchanges are imported into the keystore where they are called by the runtime.

(ZOS) In the following table, the values in the "Default values with a z/OS security product" column correspond to the default values used when the Use a z/OS security product option is indicated on the Administrative Security Selection panel of the z/OS Profile Management Tool. This option is the first option on the Administrative Security Selection panel. The values in the "Default values with WAS security" column correspond to the default values used with the Use WAS option is indicated on the Administrative Security Selection panel of the z/OS Profile Management Tool. This option is the second option on the Administrative Security Selection panel.

Property Default Description
com.ibm.ssl.trustStoreName ClientDefaultTrustStore Name of the truststore as it is referenced by the runtime. Other SSL configurations can reference further down in the ssl.client.props file to avoid duplication.
com.ibm.ssl.trustStore ${user.root}/etc/trust.p12 Location of the truststore in the format required by the truststore type referenced by the com.ibm.ssl.trustStoreType property. Typically, this property references a truststore file name. However, for cryptographic token types, this property references a DLL file.
If we are using a 4764 cryptography card, then the keystore file name for the client configuration should be specified as the file 4764.cfg in a directory structure of our choice, and the corresponding com.ibm.ssl.keyStoreType should be set to PKCS11. The 4764.cfg file is NOT supplied with WAS.
com.ibm.ssl.trustStorePassword WebAS Default password, which is the cell name for the profile when it is created. The password is typically encoded using an {xor} algorithm. We can use iKeyman to change the password in the keystore, then change the reference in this property. If we do not know the password and if the certificate was created for you, change the password in this property, then delete the truststore from the location where it resides. Restart the client to recreate the truststore using the new password, but only if the keystore name ends with DefaultTrustStore and the fileBased property is true. IBM recommends that you delete the keystore and the truststore at the same time so that a proper signer exchange can occur when both are recreated together.
com.ibm.ssl.trustStoreType PKCS12 Truststore type. Use the default PKCS12 type because of its interoperability with other applications. Specify this property as any valid truststore type supported by the JVM functionality on the provider list.
com.ibm.ssl.trustStoreProvider IBMJCE Truststore provider for the truststore type. The provider is typically IBMJCE or IBMPKCS11Impl for cryptographic devices.
com.ibm.ssl.trustStoreFileBased true This property indicates to the runtime that the truststore is file-based, meaning it is located on the file system.
com.ibm.ssl.trustStoreReadOnly false This property indicates to the run time for WAS whether the truststore can be modified during the run time.

(ZOS)

Property Default values with a z/OS security product Default values with WAS security Description
com.ibm.ssl.trustStoreName ClientDefaultTrustStore ClientDefaultTrustStore Name of the truststore as it is referenced by the runtime. Other SSL configurations can reference further down in the ssl.client.props file to avoid duplication.
com.ibm.ssl.trustStore safreyring:///your_keyring

This value is set on the SSL Customization panel of the z/OS Profile Management Tool.
${user.root}/etc/trust.p12 Location of the truststore in the format required by the truststore type referenced by the com.ibm.ssl.trustStoreType property. Typically, this property references a truststore file name. However, for cryptographic token types, this property references a DLL file.
com.ibm.ssl.trustStorePassword password WebAS Default password, which is the cell name for the profile when it is created. The password is typically encoded using an {xor} algorithm. We can use iKeyman to change the password in the keystore, then change the reference in this property. If we do not know the password and if the certificate was created for you, change the password in this property, then delete the truststore from the location where it resides. Restart the client to recreate the truststore using the new password, but only if the keystore name ends with DefaultTrustStore and the fileBased property is true. IBM recommends that you delete the keystore and the truststore at the same time so that a proper signer exchange can occur when both are recreated together.
com.ibm.ssl.trustStoreType JCERACFKS PKCS12 Truststore type. Use the default PKCS12 type because of its interoperability with other applications. Specify this property as any valid truststore type supported by the JVM functionality on the provider list. The type can be JCERACFKS, JCECCARACFKS, or JCECCAKS for cryptographic devices.
com.ibm.ssl.trustStoreProvider IBMJCE IBMJCE Truststore provider for the truststore type. The provider is typically IBMJCE or IBMPKCS11Impl for cryptographic devices.
com.ibm.ssl.trustStoreFileBased false true This property indicates to the runtime that the truststore is file-based, meaning it is located on the file system.
com.ibm.ssl.trustStoreReadOnly true false This property indicates to the run time for WAS whether the truststore can be modified during the run time. For example, we cannot modify read-only truststores using the Administrative Console or through scripting. SAF Keyrings, which are used by WAS for z/OS, are always read-only.

Related:

Keystore configurations for SSL
Create a Secure Sockets Layer configuration
Associate a Secure Sockets Layer configuration dynamically with an outbound protocol and remote secure endpoint
Example: Enable certificate revocation checking with the default IbmPKIX trust manager

Property	Default	Description
com.ibm.ssl.defaultAlias	DefaultSSLSettings	Default alias used whenever an alias is not specified by the protocol that calls the JSSEHelper API to retrieve an SSL configuration. This property is the final arbiter on the client side for determining which SSL configuration to use.
com.ibm.ssl.validationEnabled	false	When true, validate each SSL configuration as it is loaded. Use this property for debug purposes only, to avoid unnecessary performance overhead during production.
com.ibm.ssl.performURLHostNameVerification	false	When true, enforce URL host name verification. When HTTP URL connections are made to target servers, the common name (CN) from the server certificate must match the target host name. Without a match, the host name verifier rejects the connection. The default value of false omits this check. As a global property, it sets the default host name verifier. Any javax.net.ssl.HttpsURLConnection object can choose to enable host name verification for that specific instance by calling the setHostnameVerifier method with its own HostnameVerifier instance. This property does not apply to SSL channels.
com.ibm.security.useFIPS	false	When true, FIPS-compliant algorithms are used for SSL and other Java Cryptography Extension (JCE)-specific applications. This property is typically not enabled unless the property is required by the operating environment.
com.ibm.websphere.security.FIPSLevel	false	Level of the security standard to use. Valid values include 140-2, SP800-131 and transition. The com.ibm.security.useFIPS property must be set to true to enable suite B. The property must be entered in the ssl.client.props file in the global properties section, preferably after com.ibm.security.useFIPS.
com.ibm.websphere.security.suiteB	false	Level of Suite B security standard to enable. Valid values include 128 and 192. To enable the com.ibm.security.useFIPS property. it must be set to true. The property must be entered in the ssl.client.props file in the global properties section, preferably after com.ibm.security.useFIPS.
(ZOS) user.root	(ZOS) ${WASROOT}	(ZOS) This property can be used by key and truststore location properties as a single property for specifying the root path to the key and truststores. ${WASROOT} is the root directory of the current profile. Typically, this property is the profile root. However, we can modify this property to any root directory on the local machine that has the proper read and potentially write authority to that directory.

Property	Default	Description
com.ibm.ssl.defaultCertReqAlias	default_alias	Default alias to use to reference the self-signed certificate created in the keystore. If the alias already exists with that name, the default alias is appended with _#, where the number sign (#) is an integer that starts with 1 and increments until it finds a unique alias.
com.ibm.ssl.defaultCertReqSubjectDN	cn=${hostname}, o=IBM,c=US	Use the property distinguished name (DN) that we set for the certificate when it is created. The ${hostname} variable is expanded to the host name on which it resides. Use correctly formed DNs as specified by the X.509 certificate.
com.ibm.ssl.defaultCertReqDays	365	Validity period for the certificate and can be as small as 1 day and as large as the maximum number of days that a certificate can be set, which is approximately 15 years.
com.ibm.ssl.defaultCertReqKeySize	1024	Default key size. The valid values depend upon the Java Virtual Machine (JVM) security policy files installed. By default, the product JVMs ship with the export policy file that limits the key size to 1024. To get a large key size such as 2048, we can download the restricted policy files from the website.

Property	Default	Description
com.ibm.ssl.alias	DefaultSSLSettings	Name of this SSL configuration. Must be the first property for an SSL configuration because it references the SSL configuration. If we change the name of this property after it is referenced elsewhere in the configuration, the runtime defaults to the com.ibm.ssl.defaultAlias property whenever the reference is not found. The error trust file is null or key file is null might display when we start an application using an SSL reference that is no longer valid.
com.ibm.ssl.protocol	SSL_TLS	SSL handshake protocol used for this SSL configuration. This property attempts Transport Layer Security (TLS) first, but accepts any remote handshake protocol, including SSLv3 and TLSv1. Valid values for this property include SSL_TLS, SSL, SSLv2 (client side only), SSLv3, TLS, TLSv1, SSL_TLSv2, TLSv1.1, and TLSv1.2.
com.ibm.ssl.securityLevel	STRONG	Cipher group used for the SSL handshake. The typical selection is STRONG, which specifies 128-bit or higher ciphers. The MEDIUM selection provides 40-bit ciphers. The WEAK selection provides ciphers that do not perform encryption, but do perform signing for data integrity. If we specify our own cipher list selection, uncomment the property com.ibm.ssl.enabledCipherSuites. The use of javax.net.ssl system properties causes this value to always be HIGH.
com.ibm.ssl.trustManager	IbmX509	Default trust manager that we must use to validate the certificate sent by the target server. This trust manager does not perform certificate revocation list (CRL) checking. We can choose to change this value to IbmPKIX for CRL checking using CRL distribution lists in the certificate, which is a standard way to perform CRL checking. When we want to perform custom CRL checking, we must implement a custom trust manager and specify the trust manager in the com.ibm.ssl.customTrustManagers property. The IbmPKIX option might affect performance because this option requires IBMCertPath for trust validation. Use IbmX509 unless CRL checking is necessary. If we are using the Online Certificate Status Protocol (OCSP) properties, set this property value to IbmPKIX.
com.ibm.ssl.keyManager	IbmX509	Default key manager to use for choosing the client alias from the specified keystore. This key manager uses the com.ibm.ssl.keyStoreClientAlias property to specify the keystore alias. If not specified, the choice is delegated to JSSE. JSSE typically chooses the first alias that it finds.
com.ibm.ssl.contextProvider	IBMJSSE2	Choose the JSSE provider for the SSL context creation. IBM recommends defaulting to IBMJSSE2 when we use a Java virtual machine (JVM). The client plug-in can use the SunJSSE provider when using a Sun JVM.
com.ibm.ssl.enableSignerExchangePrompt	true	This property determines whether to display the signer exchange prompt when a signer is not present in the client truststore. The prompt displays information about the remote certificate so that WAS can decide whether or not to trust the signer. It is very important to validate the certificate signature. This signature is the only reliable information that can guarantee that the certificate has not been modified from the original server certificate. For automated scenarios, disable this property to avoid SSL handshake exceptions. Run the retrieveSigners script, which sets up the SSL signer exchange, to download the signers from the server prior to running the client. If we are using the Online Certificate Status Protocol (OCSP) properties, set this property value to false.
com.ibm.ssl.keyStoreClientAlias	default	Reference an alias from the specified keystore when the target does not request client authentication. When WAS creates a self-signed certificate for the SSL configuration, this property determines the alias and overrides the global com.ibm.ssl.defaultCertReqAlias property.
com.ibm.ssl.customTrustManagers	Commented out by default	Enable specification of one or more custom trust managers, which are separated by commas. These trust managers can be in the form of algorithm\|provider or classname. For example, IbmX509\|IBMJSSE2 is in the algorithm\|provider format, and the com.acme.myCustomTrustManager interface is in the classname format. The class must implement the javax.net.ssl.X509TrustManager interface. Optionally, the class can implement the com.ibm.wsspi.ssl.TrustManagerExtendedInfo interface. These trust managers run in addition to the default trust manager specified by the com.ibm.ssl.trustManager interface. These trust managers do not replace the default trust manager.
com.ibm.ssl.customKeyManager	Commented out by default	Enable you to have one, and only one, custom key manager. The key manager replaces the default key manager specified in the com.ibm.ssl.keyManager property. The form of the key manager is algorithm\|provider or classname. See the format examples for the com.ibm.ssl.customTrustManagers property. The class must implement the javax.net.ssl.X509KeyManager interface. Optionally, the class can implement the com.ibm.wsspi.ssl.KeyManagerExtendedInfo interface. This key manager is responsible for alias selection.
com.ibm.ssl.dynamicSelectionInfo	Commented out by default	Enable dynamic association with the SSL configuration. The syntax for a dynamic association is outbound_protocol, target_host, or target_port. For multiple specifications, use the vertical bar ( \| ) as the delimiter. We can replace any of these values with an asterisk (*) to indicate a wildcard value. Valid outbound_protocol values include: IIOP, HTTP, LDAP, SIP, BUS_CLIENT, BUS_TO_WEBSPHERE_MQ, BUS_TO_BUS, and ADMIN_SOAP. When we want the dynamic selection criteria to choose the SSL configuration, uncomment the default property, and add the connection information. For example, add the following on one line com.ibm.ssl.dynamicSelectionInfo=HTTP,.ibm.com,443\|HTTP,.ibm.com,9443
com.ibm.ssl.enabledCipherSuites	Commented out by default	Specify a custom cipher suite list and override the group selection in the com.ibm.ssl.securityLevel property. The valid list of ciphers varies according to the provider and JVM policy files that are applied. For cipher suites, use a space as the delimiter.
com.ibm.ssl.keyStoreName	ClientDefaultKeyStore	Keystore configuration name. If we have not already defined the keystore, the rest of the keystore properties must follow this property. After defining the keystore, we can specify this property to reference the previously specified keystore configuration. New keystore configurations in the ssl.client.props file have a unique name.
com.ibm.ssl.trustStoreName	ClientDefaultTrustStore	This property references a truststore configuration name. If we have not already defined the truststore, the rest of the truststore properties must follow this property. After defining the truststore, we can specify this property to reference the previously specified truststore configuration. New truststore configurations in the ssl.client.props file should have a unique name.

Property	Default	Description
com.ibm.ssl.keyStoreName	ClientDefaultKeyStore	Name of the keystore as it is referenced by the runtime. Other SSL configurations can reference this name further down in the ssl.client.props file to avoid duplication.
com.ibm.ssl.keyStore	${user.root}/etc/key.p12	Location of the keystore in the required format of the com.ibm.ssl.keyStoreType property. Typically, this property references a keystore file name. However, for cryptographic token types, this property references a Dynamic Link Library (DLL) file. If we are using a 4764 cryptography card, then the keystore file name for the client configuration should be specified as the file 4764.cfg in a directory structure of our choice, and the corresponding com.ibm.ssl.keyStoreType should be set to PKCS11. The 4764.cfg file is NOT supplied with WAS.
com.ibm.ssl.keyStorePassword	WebAS	Default password, which is the cell name for the profile when it is created. The password is typically encoded using an {xor} algorithm. Use iKeyman to change the password in the keystore, then change this reference. If we do not know the password and if the certificate is created for you, change the password in this property, then delete the keystore from the location where it resides. Restart the client to recreate the keystore using the new password, but only if the keystore name ends with DefaultKeyStore and if the fileBased property is true. Delete both the keystore and truststore at the same time so that a proper signer exchange can occur when both are recreated together.
com.ibm.ssl.keyStoreType	PKCS12	Keystore type. Use the default, PKCS12, because of its interoperability with other applications. Specify this property as any valid keystore type supported by the JVM on the provider list.
com.ibm.ssl.keyStoreProvider	IBMJCE	The IBM Java Cryptography Extension property is the keystore provider for the keystore type. The provider is typically IBMJCE or IBMPKCS11Impl for cryptographic devices.
com.ibm.ssl.keyStoreFileBased	true	This property indicates to the runtime that the keystore is file-based, meaning it is located on the file system.
com.ibm.ssl.keyStoreReadOnly	false	This property indicates to the run time for WAS whether the key store can be modified during the run time.

Property	Default	Description
com.ibm.ssl.trustStoreName	ClientDefaultTrustStore	Name of the truststore as it is referenced by the runtime. Other SSL configurations can reference further down in the ssl.client.props file to avoid duplication.
com.ibm.ssl.trustStore	${user.root}/etc/trust.p12	Location of the truststore in the format required by the truststore type referenced by the com.ibm.ssl.trustStoreType property. Typically, this property references a truststore file name. However, for cryptographic token types, this property references a DLL file. If we are using a 4764 cryptography card, then the keystore file name for the client configuration should be specified as the file 4764.cfg in a directory structure of our choice, and the corresponding com.ibm.ssl.keyStoreType should be set to PKCS11. The 4764.cfg file is NOT supplied with WAS.
com.ibm.ssl.trustStorePassword	WebAS	Default password, which is the cell name for the profile when it is created. The password is typically encoded using an {xor} algorithm. We can use iKeyman to change the password in the keystore, then change the reference in this property. If we do not know the password and if the certificate was created for you, change the password in this property, then delete the truststore from the location where it resides. Restart the client to recreate the truststore using the new password, but only if the keystore name ends with DefaultTrustStore and the fileBased property is true. IBM recommends that you delete the keystore and the truststore at the same time so that a proper signer exchange can occur when both are recreated together.
com.ibm.ssl.trustStoreType	PKCS12	Truststore type. Use the default PKCS12 type because of its interoperability with other applications. Specify this property as any valid truststore type supported by the JVM functionality on the provider list.
com.ibm.ssl.trustStoreProvider	IBMJCE	Truststore provider for the truststore type. The provider is typically IBMJCE or IBMPKCS11Impl for cryptographic devices.
com.ibm.ssl.trustStoreFileBased	true	This property indicates to the runtime that the truststore is file-based, meaning it is located on the file system.
com.ibm.ssl.trustStoreReadOnly	false	This property indicates to the run time for WAS whether the truststore can be modified during the run time.