HP NonStop SSL, Reference Manual

Page: 101 / 127

HP NonStop SSL Reference Manual SSL Reference
•
101
certificate" along with the "certificate chain" to the client. The certificate chain is a series of certificates issued by
successive CAs that reflect the certificate hierarchy up to the root certificate
Vice versa, the server can optionally request the client to present a certificate for authentication (SSL client
authentication, this is currently not supported by HP NonStop SSL).
HP NonStop SSL supports X.509 certificates for server authentication as follows:
•
If HP NonStop SSL is running as SSL server (run modes FTPS, TELNETS, PROXYS, EXPANDS) HP
NonStop SSL will send the configured server certificates to the client. It is up to the client to check for the
proper server certificates. The certificates are configured using the parameters SERVKEY, SERVKEYPASS,
SERVCERT and CACERTS; please see in the parameter reference for usage of those parameters. Please see the
next section on how to generate your own certificates.
•
If HP NonStop SSL is running as a SSL client (run modes FTPC, PROXYC), the TRUST parameter is used to
configure a list of trusted root certificates. It is up to the SSL server to send the certificates; HP NonStop SSL
will validate the integrity of the certificate chain and check if the root certificate's fingerprint is configured in
the TRUST parameter. Note that the default value * for the TRUST parameter is interpreted as "do not validate
the remote certificate".
Configuring SSL for Production as SSL Server
The default installation of HP NonStop SSL is streamlined to enable an easy setup and immediate testing. HP NonStop
SSL is delivered with a set of certificate and key files which can be used out-of-the-box for testing and evaluation
purposes.
For a secure production installation, it is mandatory to configure HP NonStop SSL to use your own certificate and key
files. Using the default files and settings for a production installation may compromise the security of the system.
OpenSSL toolkits, available as shareware, can help you generate your own SSL certificate.
This section will describe how to generate your own certificates. It also explains how HP NonStop SSL is configured to
use these certificates for a production installation. For a more detailed explanation about the concept of certificates, see
the section "
X.509 Certificates " of this chapter.
Using Your Own Server Key and Certificate Files
You will need at least the following components to configure SSL Server Authentication with your own production
certificates:
1. A private key (protected by a pass phrase).
2. A server certificate incorporating the public key matching the private key.
3. The certificate of the root CA that issued (i.e. signed) the server certificate.
To obtain the certificates required for SSL server authentication you may choose one of the following options:
•
Purchase a server certificate from a commercial CA
•
Obtain a server certificate from an existing internal Certificate Authority of your organization.
•
Be your own (root) Certificate Authority to issue a server certificate.
Which option you choose for your production system depends on the nature of your application, the type of users
accessing it and on the existing security infrastructure.
If your organization already maintains an internal public key infrastructure (PKI), you would want to obtain a server
certificate from an internal CA.
If your server is accessed by external internet users (e.g. customers) that do not know your organization yet, you would
probably purchase a server certificate. Remember certificates are used to establish trust. The users trust the CA you
purchased your server certificate from, while the CA vouches for your certificate's correctness.