Table of Contents
Advertisement
Chapter 14. Crypto Validation Credentials configuration mode
This chapter provides an alphabetic listing of commands that are available in
Crypto Validation Credentials configuration mode.
To enter this configuration mode, use the Crypto valcred command. While in this
mode, compile a Validation Credentials List to validate credentials that are
presented by an SSL peer.
All of the commands that are listed in "Common commands" on page 2 and most,
but not all, of the commands that are listed in Chapter 114, "Monitoring
commands," on page 949 are also available in this configuration mode.
cert-validation-mode
Specifies the method, in conjunction with the current Validation Credentials List, to
perform certificate validation.
Syntax
cert-validation-mode {legacy | pkix}
no cert-validation-mode
Parameters
legacy (Default) The behavior is that the Validation Credentials contains either the
pkix
Guidelines
The pkix method, as described in RFC 3280, expects the remote peer to provide all
intermediate certificates to the DataPower appliance during SSL negotiation. The
associated Validation Credentials List consists of self-signed certificates and
certificates of trust anchors. Certificates can be a root CA or an intermediate CA.
Use the no cert-validation-mode command to delete a certificate alias from a
Validation Credentials List.
Related Commands
certificate (Crypto)
© Copyright IBM Corp. 1999, 2008
exact peer certificate to match or the certificate of the immediate issuer,
which could be an intermediate CA or a root CA. This mode is useful
when you want to match the peer certificate exactly, but that certificate is
not a self-signed (root) certificate.
The complete certificate chain is checked from subject to root when using
this Validation Credentials for certificate validation. Validation succeeds
only if the chain ends with a root certificate in the Validation Credentials.
Non-root certificates in the Validation Credentials will be used as untrusted
intermediate certificates. Additional untrusted intermediate certificates will
be obtained dynamically from the context at hand (SSL handshake
messages, PKCS#7 tokens, PKIPath tokens, and so forth).
251
Advertisement
Table of Contents
