HP NonStop SSL, Reference Manual

Page: 58 / 127

58
•
Configuration HP NonStop SSL Reference Manual
•
The parameter is relevant for the following run modes: PROXYS (incoming socket), PROXYC (incoming
socket), FTPS (control listening socket being connected to from remote FTP client), FTPC (control listening
socket being connected to from local NonStop FTP client)
•
Use this parameter to control which IP address HP NonStop SSL binds to for incoming connections.
•
If a host name rather than an IP address is used to configure INTERFACE, name resolution will take place only
once during startup. If name resolution fails, HP NonStop SSL will terminate during startup.
•
The parameter is invalid in IPMODE DUAL since no bind address except the IPv6 ANY address '::' can handle
both IPv4 and IPv6.
See also
TARGETINTERFACE
HASHALGORITHMS
Use this parameter to define which hash algorithms are used when verifying the SSL server side based on its fingerprint.
Parameter Syntax
HASHALGORITHMS hashAlgorithm [, hashAlgorithm , ...]
Arguments
hashAlgorithm
Name of hash algorithm that should be used. If the parameter is explicitly set, at least one hash algorithm has to be
given.
Valid hash algorithms names are:
•
MD5 *
•
SHA1 *
•
RIPEMD160
•
SHA256
•
SHA384 **
•
SHA512 **
•
WHIRLPOOL
* You should not use this algorithm since it was cryptographically broken.
** Hash Algorithm not available on S-Series system
Default
By default, WHIRLPOOL as one of the two most secure algorithms is used (the other one is SHA512)
Example
HASHALGORITHMS WHIRLPOOL,SHA256
Considerations
•
Cryptographic operations, such as hashing operations, do cost CPU cycles. When e.g. running as an FTP client
proxy, fingerprint validation with hashing will be involved in every initial connection establishment process.
Therefore consider choosing only one or two algorithms out of the list.
•
Make sure to activate the algorithms actually used in the fingerprints specified in the TRUST parameter.