All BlueZone emulator clients support the SSL v3 or TLS v1 protocol through the
BlueZone Security Server or any SSL enabled Telnet connection including IBM Communications
Server for NT (SSL v3 only), OS/390, z/OS, and the iSeries V4R4 or higher. BlueZone clients
can be preconfigured for distribution with SSL/TLS enabled, eliminating the need for any
end-user intervention in the installation or configuration process. The options for
configuration include:
- Security Options
-
- Security Type
- If you want to encrypt your session, select one of the following encryption methods from
the drop-down list box. The method is dictated by the secure Telnet host that you
are connecting to.
- None: Indicates that no encryption is being
used.
- Implicit SSL/TLS: Negotiates a secure connection to
the host first, then negotiates the Telnet connection.
- Explicit SSL/TLS: Encryption is negotiated during the
Telnet negotiation.
- Security Provider
- Specifies the SSL provider.
- OpenSSL
- MS-CAPI (Default)
- SSL Version
- Specifies the version of the SSL protocol that is used:
- SSL v3: Specifies that SSL version 3 is used.
Note: SSL v3 has
numerous vulnerabilities and is no longer considered secure. This setting is NOT
RECOMMENDED. We strongly recommend using TLS v1 instead.
- TLS v1.0 (Default): Specifies that TLS version 1.0, 1.1, or 1.2
is used. The highest version supported by the client and the host will be
used.
Note: TLS v1.1 and 1.2 are not available on operating systems prior to
Windows 7.
- Preferred Cipher Suite
- Specifies a specific SSL/TLS cipher suite (encryption algorithm) to use. To allow the
client and server to negotiate the cipher suite, select Strong
only.
- Invalid Certificates
- Specifies how to handle an invalid server certificate.
- Always Reject: Specifies that an invalid server certificate
must always be rejected.
- Ask Before Accepting (Default):Specifies that the user must be
asked whether to accept an invalid server certificate.
- Always Accept: Specifies that an invalid server certificate
must always be accepted.
- Check for Certificate Revocation
- When this is checked, a revocation check is performed on the server certificate
chain at connect time, which will result in a connection failure if a certificate
has been revoked; if the revocation server cannot be contacted; or if revocation
information is not listed in the certificate. Clearing this bypasses the
certificate revocation checking.
- Alternate Principal Name
- Type a valid address in this field to use to validate the server certificate.
When a host site's server certificate's Common Name (CN) or
AltSubjectName does not match the address used to connect to the host, a certificate error
occurs, stating that the host address does not match the common name. If it is not
possible to connect to the host address listed in the certificate, the address from the
certificate can be typed into the Alternate Principal Name field.
This address, rather than the host connection address, will then be used to validate the
server certificate.