Using Web Administration

Edit online

You can use the instructions provided here to set the SSL level of encryption using Web Administration Tool.

About this task

Expand the Server administration category in the navigation area in the Web Administration Tool.

Procedure

  1. Click Manage security properties.
  2. Click Encryption.
  3. Select the method of encryption that you want to use based on the clients accessing the server. AES-128 is the default level of encryption. If you select multiple encryption methods, the highest level of encryption is used by default, however clients using the selected lower encryption levels still have access to the server.
    IBM® Verify Directory supports the Advanced Encryption Standard (AES) level of encryption. For information on AES, see the NIST Web page at http://csrc.nist.gov.
    Table 1. Supported levels of encryption
    Encryption level Attribute
    Triple DES encryption with a 168-bit key and a SHA-1 MAC ibm-slapdSslCipherSpec: TripleDES-168
    DES encryption with a 56-bit key and a SHA-1 MAC ibm-slapdSslCipherSpec: DES-56
    RC4 encryption with a 128-bit key and a SHA-1 MAC ibm-slapdSslCipherSpec: RC4-128-SHA
    RC4 encryption with a 128-bit key and a MD5 MAC ibm-slapdSslCipherSpec: RC4-128-MD5
    RC2 encryption with a 40-bit key and a MD5 MAC ibm-slapdSslCipherSpec: RC2-40-MD5
    RC4 encryption with a 40-bit key and a MD5 MAC ibm-slapdSslCipherSpec: RC4-40-MD5
    AES 128-bit encryption ibm-slapdSslCipherSpec: AES-128
    AES 256-bit encryption ibm-slapdSslCipherSpec: AES
    Note: SSL and TLS do not support AES 192 encryption.The selected ciphers are stored in the configuration file using the ibm-slapdsslCipherSpec keyword and the attribute defined from the preceding table. For example, to use only Triple DES, select Triple DES encryption with a 168-bit key and an SHA-1 MAC. The attribute ibm-slapdSslCipherSpec: TripleDES-168 is added to the ibmslapd.conf file. In this case, only clients that also support Triple DES are able to establish an SSL connection with the server. You can select multiple ciphers.
  4. If your server supports the Federal Information Processing Standards (FIPS) mode enablement feature, under the heading "Implementation" a preselected Use FIPS certified implementation check box is displayed. This enables the server to use the encryption algorithms from the ICC FIPS-certified library. If you deselect this check box the encryption algorithms from a non-FIPS certified library are used.
    Note: The server can be configured to turn FIPS Processing Mode on. It requires the FIPS-enabled libraries to also be on.
  5. When you are finished, click Apply to save your changes without exiting, or click OK to apply your changes and exit, or click Cancel to exit this panel without making any changes.