Configuring an SSL server policy
An SSL server policy is a set of SSL parameters for a server to use when booting up. An SSL server policy takes effect only after it is associated with an application such as HTTPS.
SSL versions include SSL 2.0, SSL 3.0, and TLS 1.0 (or SSL 3.1). When the device acts as the SSL server, it can communicate with clients running SSL 3.0 or TLS 1.0. When the server receives an SSL 2.0 Client Hello message from a client supporting both SSL 2.0 and SSL 3.0/TLS 1.0, it notifies the client to use SSL 3.0 or TLS 1.0 for communication.
To configure an SSL server policy:
Step | Command | Remarks |
---|---|---|
1. Enter system view. | system-view | N/A |
2. Create an SSL server policy and enter its view. | ssl server-policy policy-name | N/A |
3. Specify a PKI domain for the SSL server policy. | pki-domain domain-name | Optional. By default, no PKI domain is specified for an SSL server policy. The SSL server generates and signs a certificate for itself and does not obtain a certificate from a CA server. If SSL server authentication is required, you must specify a PKI domain and request a local certificate for the SSL server in the domain. For information about how to configure a PKI domain, see "Configuring PKI." |
4. Specify the cipher suites that the SSL server policy supports. |
| Optional. By default, an SSL server policy supports all cipher suites. |
5. Set the handshake timeout time for the SSL server. | handshake timeout time | Optional. The default handshake timeout time is 3600 seconds. |
6. Set the SSL connection close mode. | close-mode wait | Optional. By default, the SSL server sends a close-notify alert message to the client and closes the connection without waiting for the close-notify alert message from the client. |
7. Set the maximum number of cached sessions and the caching timeout time. | session { cachesize size | timeout time } * | Optional. The defaults are as follows:
|
8. Configure the server to require certificate-based SSL client authentication. | client-verify enable | Optional. By default, SSL client authentication is disabled. |
9. Enable SSL client weak authentication. | client-verify weaken | Optional. SSL client weak authentication is disabled by default. This command takes effect only when the client-verify enable command is configured. |