Hardware manual

80-001113 SysLINK Administrator’s Guide Page 29
Certification authorities, or CAs, are organizations that issue and sign digital
certificates. To verify the integrity of a remote peer's certificate, its digital signature is
compared with the signatures of the CAs that are trusted by your application.
All trusted CAs must be pre-configured in the /usr/local/ssl/cert.pem file found in
the gateway’s local filesystem. This file contains certificates for trusted CAs and is
used to verify the integrity of remote peer certificates.
3) The certificate must be owned by the correct DNS domain.
For optimum security, signed certificates should contain a fully qualified domain
name (or FQDN) that ties the certificate to a particular host or domain. Otherwise,
anyone with a valid certificate from one of your trusted CAs could intercept your
secure transmission.
This field allows you to specify which domain name to expect in the certificate. If the
certificate does not contain the expected domain name, the connection will be
aborted.
Example
Supplying a peer FQDN of ssl.yourdomain.com will require that the remote peer provide a
certificate registered to ssl.yourdomain.com, and that the certificate is signed by one of the
certification authorities found in the gateway’s /usr/local/ssl/cert.pem file.
List of Allowable Ciphers
This field specifies which authentication and encryption protocols will be allowed for this
SSL connection. To maintain maximum security, it is important to allow only those ciphers
that are sufficiently secure.
The default cipher list allows only reasonably secure ciphers to be used. If the remote peer
does not support sufficiently modern ciphers, you may need to enable some of the less-
secure ciphers.
The cipher list is specified using the same format as the standard OpenSSL cipher lists. This
list is a set of cipher strings, separated by colons, that represents the available cipher suites:
ALL: All ciphers
HIGH: High-encryption ciphers (more than 128-bits)
MEDIUM: Medium-encryption ciphers (equal to 128-bits)
LOW: Low-encryption ciphers (56- and 64-bits, excluding export ciphers)
EXP: Export encryption ciphers
TLSv1: Transport Layer Security v1.0
SSLv3: Secure Sockets Layer v3.0
SSLv2: Secure Sockets Layer v2.0
DH: Diffie-Hellman Ciphers (including anonymous DH)
ADH: Anonymous Diffie-Hellman Ciphers