Configuration Procedure - HP 3600 v2 Series Security Configuration Manual

Configuration procedure

Follow these steps to configure an SSL server policy:
To do...
Enter system view
Create an SSL server policy and
enter its view
Specify a PKI domain for the SSL
server policy
Specify the cipher suite(s) for the
SSL server policy to support
Set the handshake timeout time for
the SSL server
Set the SSL connection close mode
Set the maximum number of
cached sessions and the caching
timeout time
Configure the server to require
certificate-based SSL client
authentication
Enable SSL client weak
authentication
NOTE:
If you enable client authentication here, you must request a local certificate for the client.
•
SSL mainly comes in these versions: SSL 2.0, SSL 3.0, and TLS 1.0, where TLS 1.0 corresponds to SSL 3.1.
•
When the switch acts as an SSL server, it can communicate with clients running SSL 3.0 or TLS 1.0, and
can identify Hello packets from clients running SSL 2.0. If a client running SSL 2.0 also supports SSL 3.0
or TLS 1.0 (information about supported versions is carried in the packet that the client sends to the
server), the server notifies the client to use SSL 3.0 or TLS 1.0 to communicate with the server.
Use the command...
system-view
ssl server-policy policy-name
pki-domain domain-name
ciphersuite
[ rsa_3des_ede_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha |
rsa_des_cbc_sha |
rsa_rc4_128_md5 |
rsa_rc4_128_sha ] *
handshake timeout time
close-mode wait
session { cachesize size | timeout
time } *
client-verify enable
client-verify weaken
308
Remarks
—
Required
Required
By default, no PKI domain is
specified for an SSL server policy.
Optional
By default, an SSL server policy
supports all cipher suites.
Optional
3,600 seconds by default
Optional
Not wait by default
Optional
The defaults are as follows:
500 for the maximum number of
cached sessions,
3600 seconds for the caching
timeout time.
Optional
By default, the SSL server does not
require the client to be
authenticated.
Optional
Disabled by default.
This command takes effect only
when the client-verify enable
command is configured.