SSL and TLS notes

Determine the use of SSL and TLS functions with command-line utilities. You must install the SSL and TLS libraries and tools to use the SSL or TLS-related functions that are associated with this command.

The SSL or TLS libraries and tools are provided with GSKit, which includes security software developed by RSA Security Inc.

For information about the use of 128-bit and triple DES encryption by LDAP applications, see the information about LDAP_SSL in the IBM® Verify Directory Version 11.0.1 Programming Reference. It describes the steps that are required to build the sample programs and your applications so they can use SSL with the strongest encryption algorithms available. For more information about linking an LDAP application so that it can access 128-bit and triple DES encryption algorithms, see the makefile associated with the sample programs.

The gsk9certutil_64 tool manages the content of a client key database file. You can use the gsk9certutil_64 tool to define the set of trusted certificate authorities (CAs) that are to be trusted by the client. By obtaining certificates from trusted CAs, storing them in the key database file, and marking them as trusted, you can establish a trust relationship with LDAP servers that use trusted certificates that are issued by one of the trusted CAs. You can also use the gsk9certutil_64 tool to obtain a client certificate so that client and server authentication can be run.

If the clients use server authentication to access LDAP servers, it is sufficient to define one or more trusted root certificates in the key database file. With server authentication, the client can be assured that the target LDAP server uses a certificate by one of the trusted CAs. All LDAP transactions that use the SSL or TLS connection with the server are encrypted including the LDAP credentials that are supplied on the ldap_bind or ldap_simple_bind_s. For example, if the LDAP server is using a high-assurance VeriSign certificate, you must obtain a CA certificate from VeriSign. You must then import the certificate into your key database file, and mark it as trusted. If the LDAP server is using a self-signed server certificate, the administrator of the server can supply you a copy of the server certificate request file. Import the certificate request file into your key database file and mark it as trusted.

If the LDAP servers accessed by a client use client and server authentication, it is necessary to do the following steps.

• Define one or more trusted root certificates in the key database file. It assures the client that the target LDAP server uses a certificate by one of the trusted CAs. All LDAP transactions that flow over the SSL or TLS connection with the server are encrypted, including the LDAP credentials that are supplied on the ldap_bind or ldap_simple_bind_s.
• Create a key pair by using the gsk9certutil_64 tool and request a client certificate from a CA. After you receive the signed certificate from the CA, store the certificate in the client key database file.