TN3270 changes
In TelnetParms:
TelnetParms

;     DEBUG TRACE JOBLOG

      SECUREPORT 993

      KEYRING SAF  your RACF keyring name

      ENCRYPTION DEFAULT ENDENCRYPTION
Add the following three lines:
      EXPRESSLOGON

      CLIENTAUTH SAFCERT

      CONNTYPE ANY

      SSLTIMEOUT 120

      NOSEQUENTIALLU

EndTelnetParms
You can also find this information in the following IBM publications: