Download PDF - IBM Redbooks
Download PDF - IBM Redbooks
Download PDF - IBM Redbooks
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
The client and server perform the following steps during an SSL handshake:<br />
1. The client sends the server a message that lists the cryptographic capabilities of the client,<br />
such as the version of SSL, and the supported cipher suites.<br />
2. The server chooses the strongest common cipher suite between the client and the server,<br />
and responds with the selected cipher suite. If no common one is found, the handshake fails.<br />
3. The server sends its digital certificate to the client.<br />
4. The client verifies the validity of the server certificate by checking in its key database,<br />
which contains a list of certificates that it trusts.<br />
5. The client and server securely negotiate a symmetric encryption key and a message<br />
authentication code (MAC) key.<br />
6. The client and server securely exchange information using the cipher method selected<br />
and the keys.<br />
After an SSL connection is established between a client and server, data communications<br />
between the client and server are not apparent to the encryption and integrity added by the<br />
SSL protocol.<br />
Integrated Cryptographic Service Facility (ICSF): SSL on z/OS uses Integrated ICSF if<br />
it is available. ICSF provides hardware Cryptographic Support that is used instead of the<br />
system SSL software algorithms. For more details about ICSF, see z/OS 1.12<br />
Cryptographic Services ICSF System Programmer’s Guide, SA22-7520-14.<br />
8.4.2 Customizing the DB2 10 server to use SSL<br />
At first, use AT-TLS to provide SSL services on behalf of the DB2 10 server on z/OS. AT-TLS<br />
is a part of the z/OS Communication Server. SSL in the z/OS system supports TLS V1.0, SSL<br />
V3.0, and SSL V2.0 protocols.<br />
AT-TLS provides the following advantages when using the SSL and TLS protocols with<br />
DB2 10 on z/OS:<br />
► AT-TLS uses Resource Access Control Facility (RACF) key rings and certificates.<br />
► The Policy Agent (PAGENT) manages the rules and policies that define how SSL is used<br />
to connect to DB2 10.<br />
► PAGENT can distribute the rules and policies in a z/OS sysplex environment.<br />
This section explains the following steps to implement the SSL and TLS protocols for DB2 10:<br />
► Creating a RACF key ring and CA certificate<br />
► Configuring and activating a PAGENT policy agent<br />
► Defining and installing AT-TLS policies<br />
► Customizing DB2 10 to use a DRDA secure port for SSL<br />
Creating a RACF key ring and CA certificate<br />
Before creating a RACF key ring, generate a RACF CA certificate and a personal certificate<br />
for DB2 10. Then, connect certificates to the key ring. The following examples explain how to<br />
complete this task.<br />
126 Running SAP Solutions with <strong>IBM</strong> DB2 10 for z/OS on the <strong>IBM</strong> zEnterprise System
Change language