To enable the options on the TLS/SSL window, you must select FTP - TLS or FTP - SSL only as the protocol on the Connection window.
Transport Layer Security (TLS) and Secure Sockets Layer (SSL) are two different communication protocols that allow applications to communicate securely over the Internet using data encryption. TLS is based on SSL, but has a different initial handshake protocol and is more extensible. TLS and SSL are not interoperable. That is, an application using TLS cannot communicate with an application running SSL. Both protocols are widely used.
Server AuthenticationServer Authentication
Ensures that a secure session is established only if the internet name of the server
matches the common name in the server's certificate. This is effective only on a
locally-installed client or a client downloaded via HTTPS.
Add MSIE browser's keyring
If you click Yes, the Host On-Demand client accepts Certificate Authorities trusted
by the Microsoft Internet Explorer browser.
The following options are used to specify the handling of client authentication.
Send a Certificate
Enables Client Authentication. If you click No and the server requests
a client certificate, the server is told that no client certificate is available, and
the user is not prompted.
Certificate Source
The certificate can be kept in the client's browser or a dedicated security device such as
a smart card.
Alternatively, it can be kept in a local or network-accessed file, in PKCS12 or PFX format, protected by a password.
URL or Path and Filename
Specifies the default location of the client certificate. The URL protocols you can use
depend on the capabilities of your browser. Most browsers support HTTP, HTTPS, FTP, and FTPS.
Select File
Click Select File to browse the local file system for the file containing the certificate.
Certificate Name
Select a certificate from the list. You can also accept any certificate trusted by the server.
Add Certificate Name
Click Add Name to specify the parameters for choosing a client certificate,
including the common name, e-mail address, organizational unit, and organization used to
define it. (This button is only available on the administrator's configuration
panel.)
How often to prompt
This drop-down box allows you to control the timing of prompts for client certificates.
You can choose to prompt each time a connection is made to the server, or only the first
time after starting Host On-Demand.
If your certificate is in a password-protected file and your client supports storing preferences locally, choosing "Prompt only once" causes HOD to prompt for the password the next time the connection is made, but never after that, unless the connection attempt fails.
If your certificate is accessed through the MSIE browser, "Prompt only once" can be chosen on any client, as well as "Do not prompt", which disables the prompt from Host On-Demand, but not from the browser or security device.
Retrieve certificate before connect
If you click Yes, the client accesses its certificate before connecting the
server, whether the server requests a certificate or not. If you click no,
the client only accesses the certificate after the server has requested it; depending
on other settings, this may force the client to abnormally terminate the connection to the
server, prompt the user, and then reconnect.
Lock (Host On-Demand administrator only)
Select Lock to prevent users from changing the associated startup value for a session.
Users can not change values for most fields because the fields are unavailable. However,
functions accessed from the session menu or toolbar can be changed.
Use Jsse
You can enable this option to securely connect by using TLS v1.0, TLS v1.1, and TLS v1.2, which use Java Secure Socket Extension (JSSE). To use this option, version of the JRE (IBM or Oracle) must be V7 or later. On JRE V6 or earlier, it is possible to configure a session to use JSSE, but the JSSE-based session can run only with JRE V7 or later.
TLS Version
Select TLS v1.0, TLS v1.1, or TLS v1.2 as appropriate. When one of these options is selected, all the lower version protocols starting from TLS v1.0 are enabled. This option will be enabled by default and TLSv1.2 is selected.
Support Key Usage and Extended Key Usage
A key requirement for any solution is that the client be able to automatically recognize and utilize the correct authentication certificate on the user's smart card or browser or p12 file without user configuration or intervention to do this we have to configure the session with the Key Usage or Extended Key Usage properties.
Select Key Usage
This dialog displays all of the defined Object ID (OID) key usages. The following tabs are available:
You can choose which bits must be set in the Key Usage certificate extension, in order for a personal certificate to be eligible for use in a client authentication session.
You can choose which extended key usages must be listed in the Extended Key Usage certificate extension, in order for a personal certificate to be eligible for use in a client authentication session. The list items appear as a description (for example, Client Authentication), along with an object identifier (OID) (for example, 1.2.3.4). A checkbox indicates whether the item is selected.
Common description and OID pairs are available. You can add more description and OID pairs by clicking Add Extended Key Usage.