pegasus/doc/PegasusSSLGuidelines.htm - diff

Return to PegasusSSLGuidelines.htm CVS log

Up to [Pegasus] / pegasus / doc

Diff for /pegasus/doc/PegasusSSLGuidelines.htm between version 1.4 and 1.6.8.1

version 1.4, 2006/09/29 17:38:11

version 1.6.8.1, 2013/06/03 22:34:46

Line 318

checked first against the CRL (if specified) and then against the

server truststore. The <a href="#CLI">cimcrl CLI</a> should be used for

CRL management.

sslCipherSuite

This setting specifies the cipher list used by the server during the

SSL handshake phase. If not specified, the "DEFAULT" OpenSSL cipher

list is used. The cipher list should be mentioned between single

quotes since it can contain special characters like .+, !, -. The

cipher lists can be found at <a

href="http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT">http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT</a>

<h4>Configuration Limitations</h4>

The following are configuration limitations:

<ul>

Line 326

Line 334

password needed to unencrypt it. Therefore, the best way to secure the

file is to follow the file permissions settings specified in <a

href="#CERTS">Creating SSL Certificates.</a></li>

<li>There is no property to specify supported cipher lists at this

time. Pegasus uses the default OpenSSL cipher list. The cipher lists

can be found at <a

href="http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_</a>

and <a

href="http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_</a></li>

<li>The verification depth cannot be specified. Pegasus uses the

default OpenSSL depth of 9. This means the OpenSSL will only accept

client certificate chains up to 9 levels deep.</li>

Line 524

Line 526

<ul>

client.connect( hostname, port, SSLContext(trustStore,

certPath, keyPath, verifyCert, randomFile), username, password);

certPath, keyPath, verifyCert, randomFile, cipherSuite), username, password);

</ul>

Here's a code snippet that shows how to call a client constructor

Line 558

Line 560

does not perform by default.</li>

<li>randomFile -- A file to seed the pseudo random number

generator (PRNG).</li>

<li>cipherSuite -- This specifies the cipher list used by the

client during the SSL handshake phase. This is an experimental

interface.</li>

</ul>

Here are some general guidelines on implementing peer verification

for the client:

Line 618

Line 623

<ul>

<li>The verification depth cannot be specified. Pegasus uses the

default OpenSSL depth of 9.</li>

<li>The cipher list cannot be specified. Pegasus uses the default

OpenSSL cipher list. The cipher lists can be found at <a

href="http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#SSL_v3_0_cipher_suites_</a>

and <a

href="http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_">http://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_</a></li>

<li>No hostname checking is performed to ensure that the subject

field of the distinguished name (DN) matches the hostname. If desired,

a user-specified callback should be configured to perform this check or

Line 690

<hr>

Licensed to The Open Group (TOG) under one or more contributor license

Hewlett-Packard Development Company, L.P.; IBM Corp.; The Open Group;

agreements. Refer to the OpenPegasusNOTICE.txt file distributed with

VERITAS Software Corporation

this work for additional information regarding copyright ownership.

Each contributor licenses this file to you under the OpenPegasus Open

Permission is hereby granted, free of charge, to any

Source License; you may not use this file except in compliance with the

person obtaining a copy  of this software and associated

License.

documentation files (the "Software"), to deal in the Software without

Permission is hereby granted, free of charge, to any person obtaining a

restriction, including without limitation the rights to use, copy,

copy of this software and associated documentation files (the "Software"),

modify, merge, publish, distribute, sublicense, and/or sell copies of

to deal in the Software without restriction, including without limitation

the Software, and to permit persons to whom the Software is furnished

the rights to use, copy, modify, merge, publish, distribute, sublicense,

to do so, subject to the following conditions:

and/or sell copies of the Software, and to permit persons to whom the

Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included

THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE

in all copies or substantial portions of the Software.

SHALL BE INCLUDED IN ALL COPIES OR SUBSTANTIAL PORTIONS OF THE

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

SOFTWARE. THE SOFTWARE IS PROVIDED  "AS IS", WITHOUT WARRANTY OF

OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY

NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE

CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION

TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION

SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

<hr>

</body>

</html>

Legend:

Removed from v.1.4
changed lines
	Added in v.1.6.8.1

No CVS admin address has been configured