Implementing TLS Security in a PowerExchange Network

Back Next

Step 4D. Configure TLS Clients on Linux, UNIX or Windows

Depending on how you want to configure TLS processing, you must include some or all of the following statements in the DBMOVER file on the Linux, UNIX, or Windows client machine:

NODE. Specifies the server to which to connect in TLS mode. In this statement, include the following parameters:

Specify the ZOSSSL parameter when accessing a

z/OS

server in TLS mode.

Specify the SSL parameter to access a Linux, UNIX, or Windows server in TLS mode.

Specify N as the last parameter of the NODE statement if the remote peer does not verify certificates. For example, if the AT-TLS HANDSHAKE ROLE is set to SERVER, or if the SSL_REQ_CLNT_CERT option is set to N, then specify N as the last parameter in the NODE statement.

SSL. Specifies the TLS key and passphrase that you use to make the connection. If the client requests server authentication, also specifies the certificate authority list (CALIST).

SSL_REQ_SRVR_CERT. Specifies whether the OpenSSL library verifies that the issuer of the remote server subject certificate is a locally trusted CA certificate specified in the SSL CALIST or CAPATH parameter. Set this parameter to Y if both of the following conditions are true:

You need to verify the identify of the remote machine. For example, another machine might be impersonating a server on your network.

You have or your security administrator has a technical understanding of certificates and can coordinate the locally trusted CA certificates with the remote PowerExchange Listener subject certificates.

SSL_ALLOW_SELFSIGNED. Specifies whether to allow self-signed certificates if the client requests server authentication. Set this statement to Y if certificate verification is performed, and the OpenSSL library rejects the local CA certificate.

If the local CA certificate is rejected once, it will also fail for all other incoming connection attempts.

For example, the following DBMOVER statements configure TLS communication and disable the authentication of peer certificates:

NODE=(server_listener,TCPIP,remote_host,port_number,,,,,,SSL)
SSL=(PASS=passphrase,KEY=personalkey.pem)
SSL_REQ_CLNT_CERT=N
SSL_REQ_SRVR_CERT=N

When you disable authentication of peer certificates, you can omit the CALIST and CAPATH parameters from the SSL statement.

Rename Saved Search

Table of Contents

Implementing TLS Security in a PowerExchange Network

Implementing TLS Security in a PowerExchange Network

Step 4D. Configure TLS Clients on Linux, UNIX or Windows

Step 4D. Configure TLS Clients on Linux, UNIX or Windows