NextGen Knowledge Center

Apply Destination Connector SSL Settings

  1. On the Channels page, double-click a channel in the Channel list.
  2. Select the Destinations tab.
  3. In the Connector Type field, select the connector type that supports the SSL Manager (HTTP Sender, Web Service Sender, File Writer in FTP mode).
  4. In the SSL Settings section, the SSL Manager is inactive.
    • If you populate the URL field in the HTTP Sender Settings section, the field turns yellow with a Lock icon next to the URL.
    • If you move the pointer over the Lock icon, a tool tip appears that explains the reason for the situation. (Selecting the Lock icon opens a window with the same content as the tool tip.)
      Adding a URL while the Manager is Inactive

  5. In the SSL Settings section - Use SSL Manager field, select Yes to nullify the locked condition and enable all security options and two-way authentication. (The URL field turns green to reflect the change.)
    Enabling SSL Manager

  6. Select the wrench icon to open the SSL Settings window:
    Items on the SSL Settings Window

    ItemNameDefault ValueDescription
    AServer Certificate ValidationEnabled

    If enabled, only the certificates configured in the below Trusted Client Certificates section will be trusted.

    If disabled, all certificates are automatically trusted.

    BTrusted Server CertificatesJava Truststore onlySelect the wrench icon here to select which certificates to trust. This applies not only to certificates presented by servers, but also to those trusted for CRL / OCSP revocation checking. For additional information, seeTrusted Server Certificates
    CHostname VerificationEnabled

    If enabled, validation will fail if the Subject CN (or Subject Alternative Name) presented in the server certificate does not match the actual endpoint the connector is dispatching to.

    If disabled, valid certificates will be accepted even if the host name does not match.

    DSubject DN ValidationNo

    If enabled, only server certificates with subject distinguished names (DNs) matching the given list will be allowed. If a server certificate not matching any of the trusted DNs is presented, the SSL connection / handshake will fail.

    For additional information, see Subject DN Validation

    EAllow Expired CertificatesNoIf disabled, both local and remote certificates will be checked during the SSL handshake to ensure that none of the certificates in the accessible chain have expired.
    FOCSP Revocation CheckingNo

    Select Yes to enable Online Certificate Server Protocol (OCSP) checking for all local and remote certificates. The issuer of the response certificate must be trusted as well in order to verify signatures.

    For additional information, see OCSP Revocation Checking

    GCRL Revocation CheckingNo

    Select Yes to enable Certificate Revocation List (CRL) checking for all local and remote certificates. The issuer of the CRL must be included in your trusted certificates as well in order to verify signatures.

    For additional information, see CRL Revocation Checking

    HMy Client CertificateNoneIf client/mutual authentication is needed, select the local certificate used to identify this connector. For additional information, see My Client Certificate
    IEnabled ProtocolsServer defaults

    The TLS/SSL protocols to enable for this listener connector.

    For additional information, see Enabled TLS/SSL Protocols

    JEnable Sipher SuitesServer defaults

    The TLS/SSL cipher suites to enable for this listener connector.

    For additional information, see Enabled TLS/SSL Cipher Suites