pegasus/doc/PegasusSSLGuidelines.htm - diff

Return to PegasusSSLGuidelines.htm CVS log

Up to [Pegasus] / pegasus / doc

Diff for /pegasus/doc/PegasusSSLGuidelines.htm between version 1.6 and 1.7

version 1.6, 2008/12/18 16:41:52

version 1.7, 2012/03/30 04:22:50

Line 318

checked first against the CRL (if specified) and then against the

server truststore. The <a href="#CLI">cimcrl CLI</a> should be used for

CRL management.

sslCipherSuite

This setting specifies the cipher list used by the server during the

SSL handshake phase. If not specified, the "DEFAULT" OpenSSL cipher

list is used. The cipher list should be mentioned between single

quotes since it can contain special characters like .+, !, -. The

cipher lists can be found at <a

href="http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT">http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT</a>

<h4>Configuration Limitations</h4>

The following are configuration limitations:

<ul>

Line 326

Line 334

password needed to unencrypt it. Therefore, the best way to secure the

file is to follow the file permissions settings specified in <a

href="#CERTS">Creating SSL Certificates.</a></li>

<li>There is no property to specify supported cipher lists at this

time. Pegasus uses the default OpenSSL cipher list. The cipher lists

can be found at <a

href="http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_</a>

and <a

href="http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_</a></li>

<li>The verification depth cannot be specified. Pegasus uses the

default OpenSSL depth of 9. This means the OpenSSL will only accept

client certificate chains up to 9 levels deep.</li>

Line 524

Line 526

<ul>

client.connect( hostname, port, SSLContext(trustStore,

certPath, keyPath, verifyCert, randomFile), username, password);

certPath, keyPath, verifyCert, randomFile, cipherSuite), username, password);

</ul>

Here's a code snippet that shows how to call a client constructor

Line 558

Line 560

does not perform by default.</li>

<li>randomFile -- A file to seed the pseudo random number

generator (PRNG).</li>

<li>cipherSuite -- This specifies the cipher list used by the

client during the SSL handshake phase. This is an experimental

interface.</li>

</ul>

Here are some general guidelines on implementing peer verification

for the client:

Line 618

Line 623

<ul>

<li>The verification depth cannot be specified. Pegasus uses the

default OpenSSL depth of 9.</li>

<li>The cipher list cannot be specified. Pegasus uses the default

OpenSSL cipher list. The cipher lists can be found at <a

href="http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_</a>

and <a

href="http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_</a></li>

<li>No hostname checking is performed to ensure that the subject

field of the distinguished name (DN) matches the hostname. If desired,

a user-specified callback should be configured to perform this check or

Legend:

Removed from v.1.6
changed lines
	Added in v.1.7

No CVS admin address has been configured