Hp Secure Key Manager Manuel d'utilisateur télécharger pdf (Page 165)

In this scenario, the client application indicates that it is willing to perform an SSL resume (rather than

a full handshake) by sending a previously negotiated session–id in the CLIENT–HELLO message. The

SKM checks that it has the session key for the given session–id. If so, it acknowledges that it is willing

to resume the session by using the same session–id in the SERVER–HELLO message. Otherwise, the

SKM responds with a new session–id.

SSL Session Ti

meout

All SSL sessions stored in the SKM’s session cache have an expiration period, typically two hours.

This means the SKM accepts a session resume request for at most two hours after the session is ﬁrst

established

. Consequently, every client application must renegotiate a session–key at least once every

two hours. Th

is limits the amount of information encrypted with a particular session–key. Hence, an

attacker who is able to deduce a session key would only obtain the information exchanged during a

two hour window. The SSL session timeout on the SKM is conﬁgured on the SSL Conﬁguration page, as

described later in this chapter.

SSL Certiﬁcate Management on the SKM

Certiﬁcates are used to authenticate one entity to another. This authentication takes place during the

SSL handshake protocol. Certiﬁcates are issued by Certiﬁcation Authorities (CA’s) such as VeriSign,

Entrust, Thawte, and others. The SKM is equipped with CA capabilities, and can issue certiﬁcates for

all your applications.

When establishing an SSL connection with a client, you can require that the client authenticate itself to the

SKM by presenting a certiﬁcate. Because the SKM can issue certiﬁcates to applications and databases,

there is no need for you to use a public CA such as VeriSign to issue these certiﬁcates. You can generate

these certiﬁcates on the SKM.

The HP CA is managed on the CA Certiﬁcates page. To issue certiﬁcates for your applications, you must

ﬁrstcreatealocalCAontheSKM.ThislocalCAisthenusedtoissuecertiﬁcates for all your applications.

Local certiﬁcates issued by the HP CA are only valid for authenticating to the SKM.

SSL Sections

The SSL C

onﬁguration page enables you to manage your SSL settings. This page contains the following

SSL-related sections:

•SSLOptions

•SSLCip

her Order

SSL Options

Use this section to view and modify SSL settings. These settings affect the KMS Server’s communication

with client applications and databases when SSL is enabled. These settings also affect all connections to

the web-based Management Console.

By default, applications using SSL 2.0 (an older version of SSL) are not allowed to connect to the KMS

Server. SSL 2.0 is known to have some security vulnerabilities.

NOTE:

FIPS-compliant devices

cannot

use the default SSL conﬁguration. On those devices, you must enable

TLS 1.0 and disable SSL 2.0 and 3.0.

IMPORTANT:

Some web browsers, including Internet Explorer 6.0, do not have TLS 1.0 enabled by default. If you

disable SSL 2.0 and 3.0, please check ﬁrst that your browser has TLS 1.0 enabled. (In Internet Explorer,

select Internet Options from the Tools menu, click the Advanced tab, scroll down to the Security section,

and make sure the "Use TLS 1.0" checkbox is checked.)

Secure Key Manager

165

1 2 ... 160 161 162 163 164 165 166 167 168 169 170 ... 326 327

Commentaires sur ces manuels

Pas de commentaire

Hp Secure Key Manager Manuel d'utilisateur Page 165

Commentaires sur ces manuels

Produits connexes et manuels pour Stockage Hp Secure Key Manager