Re: TN5250 SSL Client Authentication

[James Rich <james@xxxxxxxxxxx>]

On Fri, 4 Apr 2003, Sean Porterfield wrote:

> Has anyone successfully implemented client authentication?  I know it gets
> brought up occasionally, but I couldn't find any details in the archives.

Working on it now.  It's been real flaky.  SSL enabled sessions work for a
time and then mysteriously stop connecting.  IPL fixes it.  putting the
lastest PTFs on now.

> Then I went back to DCM and removed the assignment of the certificate to the
> user.  No change - still get a signon.  So I deleted the certificate (just
> to confuse the issue, I had created 2 certificates, so it seems I used
> "remove" for one and "delete" for the other.)  No change, still able to get
> a signon with the deleted certificate.  Ended and started telnet to be sure,
> no effect.  Even rebooted, not that it should matter since I'm trying to get
> the AS/400 to do the verification.
>
> Is this correct behavior?  Once genereated, the AS/400 will trust the
> certificate until expired even though it's been deleted?  Doesn't do much
> for our security plan...

If you don't have a certificate and you've specified to only allow
connections from authenticating hosts then you should not be able to
connect.  I guess the question is has the certificate really been deleted
and have you configured the iSeries to only connect to authorized hosts.

James Rich