Ssl Handshake; Certificate Regeneration - Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - REMOTE MANAGEMENT REFERENCE 10.3 Management Manual

After the authentication is complete, the remote session switches to an insecure mode if the Enable
Session Encryption option is disabled in the Remote Management policy and if the Session
Encryption option is disabled by the remote operator while initiating a remote session on the
managed device. However, we recommend that you continue the session in a secure mode because
there is no major impact on the performance of the session.

4.10.1 SSL Handshake

When the ZENworks Adaptive Agent is installed on a managed device, the Remote Management
service generates a self-signed certificate that is valid for 10 years.
When a remote operator initiates a remote session on the managed device, the Remote Management
viewer prompts the remote operator to verify the managed device certificate. The certificate displays
details such as name of the managed device, certificate issuing authority, the validity of the
certificate, and the fingerprint. For security reasons, the remote operator must verify the credentials
of the managed device by matching the fingerprint of the certificate against the fingerprint
communicated by the managed device user through out-of-band means. Then, the remote operator
can do one of the following:
Accept the certificate permanently: If a user who has logged in to the management console
accepts the certificate permanently, then the certificate is not displayed in the subsequent
remote sessions initiated by the users logged in that console.
Accept the certificate temporarily: If a user who has logged in to the management console
accepts the certificate temporarily, the certificate is accepted only for the current session. The
user is prompted to verify the certificate the next time a connection is initiated to the managed
device.
Reject the certificate: If a user who has logged in to the management console rejects the
certificate, the remote session terminates.

4.10.2 Certificate Regeneration

The managed device regenerates a new self-signed certificate if:
The name of the managed device has changed
The certificate is postdated and is not currently valid
The certificate has expired
The certificate is about to expire
The certificate is missing
By default, the certificate is regenerated once in every 10 years.
68 ZENworks 10 Configuration Management Remote Management Reference