SSL Certificate Configurations
For protected TCP/IP connections between the RDRS components (agent to agent, process to agent, process to process), SSL/TLS is used with certificates. For more information, see Certificates and Keys for SSL/TLS.
SSL Certificate Configurations
The necessary certificate information for the components are managed in this section.
The SSL certificate configurations context menus
A click with the right mouse key on an entry menu in the control center displays a context menu containing options for the respective entry.
- Delete configuration
- The configuration is deleted. The certificates or certificate files noted therein remain in place.
- Rename configuration
- The name of the configuration is deleted.
Definition of a new configuration:
To define a new configuration of SSL certificates, please use the 'New configuration...' branch in the 'SSL certificate configuration' area and name the new configuration. The necessary specifications can then be made on the workspace:
Defining a new configuration for Linux/Unix/Windows:
In a Linux/Unix/Windows environment the configuration contains the names of the certificate files and the password for the key file.
Use the button 
for localizing the certificate file on the respective server.
Client certificate: The certificate to be used.
CA certificate: The certificate to verify the certificate.
Key: The key with which the certificate was signed.
Key password: The password for this key.
Provider Conf.: The configuration file for the use of the desired provider. This in an optional parameter, when no provider is specified the default provider is used. Alternatively a provider can be specified using the provider definition. For the use of providers the used openSSL version must be at least 3.0.0 or higher.
Provider Def.: The definition of the used provider. This in an optional parameter, when no provider is specified the default provider is used. Alternatively a provider can be specified using the provider configuration file. For the use of providers the used openSSL version must be at least 3.0.0 or higher.
Security Level: An openSSL parameter defining requirements for ciphers and key lengths for encryption. Valid values go from 0 (no requirements) to 5 (the highest requirements). Details can be found under the following link: https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
Min. protocol version: The minimum version of the SSL Protocol to be used. When a handshake with the other side is successful the highest protocol version supported by both sides will be used. If nothing is set all protocols from SSL V3 to TLS1_3 are offered, when searching for the highest common version.
Max. protocol version: The maximum version of the SSL Protocol to be used. When a handshake with the other side is successful the highest protocol version supported by both sides will be used. If nothing is set all protocols from the minimum version to TLS1_3 are offered, when searching for the highest common version.
The button 
shows the history of previously defined configurations. This information
can then be applied again.
Definition of a new configuration in z/OS:
In a z/OS environment, the configuration contains the name of the key ring or the key database, the label of the imported certificate, and the password.
These configurations do not have to be created if AT-TLS is used in z/OS. For more information, see AT‑TLS Setup for Secure Communication Between Agents and Processes.
GSK key ring: Name of the key database that was created with gskkyman
GSK label: Name used for the certificate during import
GSK key password: Password for this key
Use FIPS mode: Indicates whether to enable the use of FIPS
Min. protocol version: The minimum version of the SSL Protocol to be used. When a handshake with the other side is successful the highest protocol version supported by both sides will be used. If nothing is set all protocols from SSL V3 to TLS1_3 are offered, when searching for the highest common version.
Max. protocol version: The maximum version of the SSL Protocol to be used. When a handshake with the other side is successful the highest protocol version supported by both sides will be used. If nothing is set all protocols from the minimum version to TLS1_3 are offered, when searching for the highest common version.
The button 
shows the history of previously defined configurations. This information
can then be applied again.
Test of certificate configuration
Changes to certificate definitions can be tested in advance to see whether a connection between the agents would be possible in this way. For that the test to be carried out, the SSL listener must be started in advance at the Agents (start parameters SSLPort, possibly SSLIPAddress= and ServerSSLCertDef=).
The test dialog lists the possible connection combinations and asks for the respective SSL port. By clicking on the test button, an attempt is made to establish a connection and the result is reported.