Information Center

TLS/SSL

To enable the options on the TLS/SSL window, you must select FTP - TLS or FTP - SSL only as the protocol on the Connection window.

Transport Layer Security (TLS) and Secure Sockets Layer (SSL) are two different communication protocols that allow applications to communicate securely over the Internet using data encryption. TLS is based on SSL, but has a different initial handshake protocol and is more extensible. TLS and SSL are not interoperable. That is, an application using TLS cannot communicate with an application running SSL. Both protocols are widely used.

Server Authentication
Add MSIE Browser's keyring
Send a Certificate
Certificate Source
URL or Path and Filename
Select File
Support Key Usage and Extended Key Usage
Certificate Name
Add Certificate Name
How Often to Prompt
Retrieve Certificate before connect
Lock
Use JSSE
TLS Version

Server Authentication
Ensures that a secure session is established only if the internet name of the server matches the common name in the server's certificate. This is effective only on a locally-installed client or a client downloaded via HTTPS.

Add MSIE browser's keyring
If you click Yes, the Z and I Emulator for Web client accepts Certificate Authorities trusted by the Microsoft Internet Explorer browser.

The following options are used to specify the handling of client authentication.

Send a Certificate
Enables Client Authentication.  If you click No and the server requests a client certificate, the server is told that no client certificate is available, and the user is not prompted.

Certificate Source
The certificate can be kept in the client's browser or a dedicated security device such as a smart card.

Alternatively, it can be kept in a local or network-accessed file that is protected by a password.

URL or Path and Filename
Specifies the default location of the client certificate. The URL protocols you can use depend on the capabilities of your browser. Most browsers support HTTP, HTTPS, FTP, and FTPS.

Select File
Click Select File to browse the local file system for the file containing the certificate.

Certificate Name
Select a certificate from the list. You can also accept any certificate trusted by the server.

Add Certificate Name
Click Add Name to specify the parameters for choosing a client certificate, including the common name, e-mail address, organizational unit, and organization used to define it.  (This button is only available on the administrator's configuration panel.)

How often to prompt
This drop-down box allows you to control the timing of prompts for client certificates. You can choose to prompt each time a connection is made to the server, or only the first time after starting Z and I Emulator for Web. 

If your certificate is in a password-protected file and your client supports storing preferences locally, choosing "Prompt only once" causes ZIEWeb to prompt for the password the next time the connection is made, but never after that, unless the connection attempt fails.

If your certificate is accessed through the MSIE browser, "Prompt only once" can be chosen on any client, as well as "Do not prompt", which disables the prompt from Z and I Emulator for Web, but not from the browser or security device.

Retrieve certificate before connect
If you click Yes, the client accesses its certificate before connecting the server, whether the server requests a certificate or not. If you click no, the client only accesses the certificate after the server has requested it; depending on other settings, this may force the client to abnormally terminate the connection to the server, prompt the user, and then reconnect.

Lock (Z and I Emulator for Web administrator only)
Select Lock to prevent users from changing the associated startup value for a session. Users can not change values for most fields because the fields are unavailable. However, functions accessed from the session menu or toolbar can be changed.

Use Jsse
You can enable this option to securely connect by using TLS v1.0, TLS v1.1, and TLS v1.2, which use Java Secure Socket Extension (JSSE). To use this option, version of the JRE (IBM or Oracle) must be V7 or later. On JRE V6 or earlier, it is possible to configure a session to use JSSE, but the JSSE-based session can run only with JRE V7 or later.

TLS Version
Select TLS v1.0, TLS v1.1, or TLS v1.2 as appropriate. When one of these options is selected, all the lower version protocols starting from TLS v1.0 are enabled. This option will be enabled by default and TLSv1.2 is selected.

Support Key Usage and Extended Key Usage

A key requirement for any solution is that the client be able to automatically recognize and utilize the correct authentication certificate on the user's smart card or browser or p12 file without user configuration or intervention to do this we have to configure the session with the Key Usage or Extended Key Usage properties.

Select Key Usage

This dialog displays all of the defined Object ID (OID) key usages. The following tabs are available:

Common description and OID pairs are available. You can add more description and OID pairs by clicking Add Extended Key Usage.

Related topics