Sun Java(TM) System Directory Server Online Help |
Encryption Tab of Server Configuration
Use this tab to configure the Secure Socket Layer (SSL) for your directory.
Enable SSL for this server. Select this checkbox to enable SSL communications for the directory. Clear the checkbox to disable SSL.
If you disable SSL for the server when you have selected the checkbox to Use SSL in Sun Java System Server Console, that checkbox will be deselected automatically and you will need to restart the Console.
If you disable SSL when a suffix has attribute encryption configured, you will be asked for confirmation. SSL is required for attribute encryption and any operations on encrypted attributes will fail when SSL is disabled.
Use this cipher family. When you have enabled SSL, select the checkbox next to the cipher family or families you want the server to use for SSL communications.
Sun Java System Directory Server currently supports two cipher families: RSA and Fortezza. The internal security device supports only RSA. If you're using a Fortezza card, you will also see the Fortezza cipher family listed here.
Cipher Family
You may set the following options for each cipher family.
Security Device. Select the device that will perform encryption computations. By default, data is encrypted internally by the Directory Server software. Other choices in this list are available only if you are using an external hardware module.
Certificate. Select the certificate you want the server to use from the list of installed certificates. You must have a certificate installed on your system to use SSL. See "Obtaining and Installing Server Certificates" in Chapter 11 of the Sun Java System Directory Server Administration Guide.
Cipher settings. Click this button to open the Encryption Preferences dialog, where you can select ciphers to use from the ciphers available with the chosen certificate.
Client Authentication
The options under this heading determine whether or not clients must authenticate with a certificate over SSL.
Do not allow client authentication. Select this option if you do not want client applications to present a certificate for authentication.
Allow client authentication. Select this option if you allow client applications to connect to the server using either simple authentication or client authentication.
If you are using certificate-based authentication with replication, then you must select either "Allow client authentication" or "Require client authentication" on the consumer server.
Require client authentication. Select this option to force client applications to connect to the server using client authentication over SSL. If you select this option, simple authentication is not allowed.
Use SSL in Sun Java System Server Console. Select this checkbox if you want the communication between the Sun Java System Server Console and the directory server to be secured using SSL.
Communication between the Sun Java System Server Console and the server will take place over a secure channel, but without client authentication, even if the "Require client authentication" option is selected.
DSML Client Authentication. Choose one of the following policies for accepting DSML requests:
HTTP Basic (use authentication in HTTP header). The server will perform identity mapping to determine the bind DN from the authentication information in the HTTP header of the request. With this setting, DSML requests to a secure HTTPS port will be encrypted through SSL but not use client certification.
Try to use client certificate first. The server will attempt to authenticate clients using the certificate sent to the secure HTTPS port. If client authentication fails with the certificate, the server will perform identity mapping using authentication information in the HTTP header of the request.
Only use client certificate. The client must send DSML requests to the secure HTTPS port and provide a valid client certificate. All other DSML requests will be rejected.
See Also
"Configuring DSML" in Chapter 1 of the Sun Java System Directory Server Administration Guide.
Chapter 11, "Implementing Security," in the Sun Java System Directory Server Administration Guide.