Implementing TLS Security in a PowerExchange Network

Back Next

Authentication

You can optionally configure PowerExchange to require server authentication of client certificates, client authentication of server certificates, or both.

If you configure a TLS server to require client authentication, the server requests the client personal certificate with its signing CA certificates. The server checks that the personal certificate of the client is up-to-date and signed by a certificate authority in the CA list of the server. The following statements determine whether the server requires client authentication:

The SSL_REQ_CLNT_CERT statement in the DBMOVER file of the TLS server on Linux, UNIX, or Windows

The HandshakeRole statement in the TTLSEnvironmentAction section of the AT-TLS policy file on z/OS

If you configure a TLS client to require server authentication, the client checks that the personal certificate of the server is in-date and signed by a certificate authority in the CA list of the client. The SSL_REQ_SRVR_CERT statement in the DBMOVER file of the TLS client determines whether the client requires server authentication.

If you configure neither the TLS server nor client to require authentication of peer certificates, network packets are still encrypted during the session.

Because clients do not typically require server authentication in a PowerExchange network, you are likely to use one of the following authentication modes:

Server requests client authentication.

Neither client nor server requests authentication.

Implementing TLS Security in a PowerExchange Network

Download Guide

Watch

Comments

Communities

Knowledge Base

Success Portal