Reference Manual

10.5.9
- 10.5.8
- 10.5.6
- 10.5.5
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5.1
- 10.5
- 10.4.1
- 10.4.0 HotFix 1
- 10.4.0

Back Next

PowerExchange SSL Configuration Steps

Before you begin SSL configuration for PowerExchange, your organization should have a local CA certificate from a well-known CA vendor. A self-signed CA certificate can be generated instead for internal use, such as connections within your organization's network or internal testing.

The steps described in this task should be performed by security administrators. Security administrators have specific permissions and system access that allow them to generate and manage security certificates and policy files.

All certificates created for use with PowerExchange must be generated to the X.509 standard. For example, the PKCS7 format meets the X.509 standard, so it can be used to generate the certificates.

To implement SSL support in PowerExchange, complete the following tasks:

Configure each z/OS server.

Configure the DBMOVER file for the PowerExchange Listener and specify the ports to be used for secure connections.

Update the rules in AT-TLS policy file specifying the job names and ports to be used for secure connections.

Make a personal certificate available on z/OS.

Configure each Linux, UNIX, Windows or IBM i machine.

Create a CA certificate.

Create a personal certificate.

Customize the DBMOVER configuration file on the server.

If remote peer certificate validation is performed, then the Certificate Authority that issued the remote certificate must be present as a trusted CA in the local system:

On z/OS, a remote peer (client) certificate is requested from the client during the handshake if the AT-TLS rule specifies a Handshake Role of "ServerWithClientAuth”, but not if the Handshake Role is “Server”. If a client certificate is requested, its validation by AT-TLS is controlled by the AT-TLS ClientAuthType option of Passthru, Full, Required, or SAFCheck. For the Passthru or Full options, it is valid for the client not to provide a certificate. Except for the Passthru case, a received certificate will be validated by AT-TLS.

The underlying cryptographic services used by AT-TLS (z/OS System SSL) expect that the certificate is well-formed even if AT-TLS is not to perform full validation. PowerExchange does not process certificates in any way.

On non- z/OS listeners, remote peer (client) certificate request and validation is performed according to the SSL_REQ_CLNT_CERT parameter.

On Linux, UNIX, and Windows clients, remote peer server certificate validation is performed according to the SSL_REQ_SRVR_CERT and ALLOW_SELF_SIGNED parameters.

Verify the secure connections between PowerExchange clients and servers using DTLREXE PING.

Rename Saved Search

Table of Contents

Reference Manual

Reference Manual

PowerExchange SSL Configuration Steps

PowerExchange SSL Configuration Steps