Configuring An Ssl Client Policy - HP MSR Series Configuration Manual

Step
6. (Optional.) Enable mandatory
or optional SSL client
authentication.

Configuring an SSL client policy

An SSL client policy is a set of SSL parameters that the client uses to establish a connection to the
server. An SSL client policy takes effect only after it is associated with an application such as DDNS.
For information about DDNS, see Layer 3—IP Services Configuration Guide.
To configure an SSL client policy:
Step
1. Enter system view.
2. Create an SSL client
policy and enter its view.
3. (Optional.) Specify a PKI
domain for the SSL client
policy.
4. Specify the preferred
cipher suite for the SSL
client policy.
Command
client-verify { enable | optional }
Command
system-view
ssl client-policy policy-name
pki-domain domain-name
•
In non-FIPS mode:
prefer-cipher
{ dhe_rsa_aes_128_cbc_sha |
dhe_rsa_aes_256_cbc_sha |
exp_rsa_des_cbc_sha |
exp_rsa_rc2_md5 |
exp_rsa_rc4_md5 |
rsa_3des_ede_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha |
rsa_des_cbc_sha |
rsa_rc4_128_md5 |
rsa_rc4_128_sha }
•
In FIPS mode:
prefer-cipher
{ dhe_rsa_aes_128_cbc_sha |
dhe_rsa_aes_256_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha }
435
Remarks
By default, SSL client
authentication is disabled. The
SSL server does not perform
digital certificate-based
authentication on SSL clients.
When authenticating a client
by using the digital certificate,
the SSL server verifies the
certificate chain presented by
the client. It also checks that
the certificates in the certificate
chain (except the root CA
certificate) are not revoked.
Remarks
N/A
By default, no SSL client policies
exist on the device.
By default, no PKI domain is
specified for an SSL client policy.
If SSL client authentication is
required, you must specify a PKI
domain and request a local
certificate for the SSL client in
the PKI domain.
For information about how to
create and configure a PKI
domain, see "Configuring
•
In non-FIPS mode:
The default preferred cipher
suite is rsa_rc4_128_md5.
•
In FIPS mode:
The default preferred cipher
suite is
sa_aes_128_cbc_sha.
PKI."