Loading...
Loading...
| Item | Name | Default Value | Description |
|---|---|---|---|
| A | My Server Certificate | None | Select the local certificate used to identify this listener connector. For additional information, see My Server Certificate |
| B | Client Authentication | Disabled | Disabled: No client authentication is requested. Request: Client certificate is requested but not required. If the client presents a certificate it will be used for extra security. Require: Client certificate is required. If the client does not present a certificate, the handshake will fail. |
| C | Client Certificate Validation | Enabled | If enabled, only the certificates configured in the below Trusted Client Certificates section will be trusted. If disabled, all certificates are automatically trusted. |
| D | Trusted Client Certificates | Java Truststore only | Select the wrench icon here to select which certificates to trust. This applies not only to certificates presented by clients for mutual authentication, but also to those trusted for CRL / OCSP revocation checking. For additional information, see Trusted Client Certificates |
| E | Present Issuer DNs | Enabled | If enabled, during the SSL handshake the server will respond with a list of accepted client issuer distinguished names (DNs). Disabling this can provide extra security as potential attackers are given less information about the correct security parameters. |
| F | Subject DN Validation | No | If enabled, only client certificates with subject distinguished names (DNs) matching the given list will be allowed. If a client certificate not matching any of the trusted DNs is presented, the SSL connection / handshake will fail. For additional information, see Subject DN Validation |
| G | Allow Expired Certificates | No | If disabled, both local and remote certificates will be checked during the SSL handshake to ensure that none of the certificates in the accessible chain have expired. |
| H | OCSP Enabled | No | Select Yes to enable Online Certificate Server Protocol (OCSP) checking for all local and remote certificates. The issuer of the response certificate must be trusted as well in order to verify signatures. For additional information, see OCSP Revocation Checking |
| I | CRL Enabled | No | Select Yes to enable Certificate Revocation List (CRL) checking for all local and remote certificates. The issuer of the CRL must be included in your trusted certificates as well in order to verify signatures. For additional information, see CRL Revocation Checking |
| J | Enabled Protocols | Server defaults | The TLS/SSL protocols to enable for this listener connector. For additional information, see Enabled TLS/SSL Protocols |
| K | Enabled Cipher Suites | Server defaults | The TLS/SSL cipher suites to enable for this listener connector. For additional information, see Enabled TLS/SSL Cipher Suites |