Configuration Procedure - HP A6600 Configuration Manual

Configuration procedure

To do...
1. Enter system view.
2. Create an SSL server policy
and enter its view.
3. Specify a PKI domain for the
SSL server policy.
4. Specify the cipher suites for
the SSL server policy to
support.
5. Set the handshake timeout
time for the SSL server.
6. Set the SSL connection close
mode.
7. Set the maximum number of
cached sessions and the
caching timeout time.
8. Configure the server to
require certificate-based SSL
client authentication.
9. Enable SSL client weak
authentication.
NOTE:
If you enable client authentication here, you must request a local certificate for the client.
•
SSL mainly comes in these versions: SSL 2.0, SSL 3.0, and TLS 1.0, where TLS 1.0 corresponds to SSL
•
3.1. When the router acts as an SSL server, it can communicate with clients running SSL 3.0 or TLS
1.0 and can identify Hello packets from clients running SSL 2.0. If a client running SSL 2.0 also
supports SSL 3.0 or TLS 1.0 (information about supported versions is carried in the packet that the
client sends to the server), the server notifies the client to use SSL 3.0 or TLS 1.0 to communicate with
the server.
Command...
system-view
ssl server-policy policy-name
pki-domain domain-name
ciphersuite [
rsa_3des_ede_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha |
rsa_des_cbc_sha |
rsa_rc4_128_md5 |
rsa_rc4_128_sha ] *
handshake timeout time
close-mode wait
session { cachesize size | timeout
time } *
client-verify enable
client-verify weaken
342
Remarks
—
Required.
Required.
By default, no PKI domain is
specified for an SSL server policy.
Optional.
By default, an SSL server policy
supports all cipher suites.
Optional.
3,600 seconds by default.
Optional.
No wait by default.
Optional.
The defaults are as follows:
• 500 for the maximum number
of cached sessions
• 3600 seconds for the caching
timeout time
Optional.
By default, the SSL server does not
require the client to be
authenticated.
Optional.
Disabled by default.
This command takes effect only
when client-verify enable is
configured.