TLS/SSL security
The TLS protocols allow a client and server to establish a secure, encrypted connection over a public network. When you connect using TLS, the client (such as Reflection) authenticates the server before opening a terminal emulation session, and all data passed between the client and the host is encrypted using the selected encryption level. Choose from these options:
|
None |
Neither TLS nor SSL is used for this connection. |
|
TLS 1.3, TLS 1.2 |
Allows connection through TLS 1.3 or TLS 1.2, depending on the capabilities of the host or server to which you are connecting. As part of the TLS protocol, the client checks the server or host name against the name on the server certificate. Therefore, TLS connections require the common name on the server certificate to match the host or security proxy server name. |
| TLS 1.3 |
Connects using only TLS 1.3. Note: TLS connections require the common name on the server certificate to match the host or security proxy server name.
|
| TLS 1.2 |
Connects using only TLS 1.2. Note: TLS connections require the common name on the server certificate to match the host or security proxy server name.
|
Certificate verification
Use Certificate verification to configure certificate
verification options such as certificate policies, CRL settings, and OCSP settings.
Note: These settings are not applicable when PKI Services Manager support is enabled by the administrator.
Use Security Proxy
When Use security proxy is enabled,
the client connects to your host via the Security Proxy Server, which requires a separate licence. When enabled, you can use the Security Proxy to configure secure connections even if your host is not running a TLS/SSL-enabled Telnet server. To support such connections, you must install and configure the Security Proxy server.
Note: Version 12.8 of the Security Proxy Server supports TLS 1.3 and TLS 1.2.
| Security proxy |
Specifies the host running the Security
Proxy Server. If you are creating or editing a session using Manage Sessions in the Administrative Console, all of the available security proxy servers are
listed here. |
| End to end encryption |
This option provides end to end encryption by tunneling
a TLS/SSL direct connection to the host through the Security Proxy. It
combines the authorization associated with the security proxy and the complete
TLS/SSL encryption associated with the TLS/SSL direct connection. The host must support
TLS/SSL direct connections to use this feature. |
The following settings are available only if the session has been launched from the Manage Sessions panel in the Administrative Console:
| Destination host |
Specify the name of the default destination host. When client
authorization is turned on (the default), each Security Proxy can connect
to multiple hosts. When client authorization is off, each Security Proxy
can connect to only one host. This remote address specifies the
host to which the Security Proxy will connect when client authorization
is off. Enter the remote address as either a host name, such
as hostname.example.com, or an IP
address, such as 123.123.100.100. If you are not connecting with the default port,
use the format Host:Port to specify an alternate port. |
| Connection details |
Connection details include a description of Security Proxy and information such
as the cipher suite used.
The status of the connection between the host and the Security Proxy server reflects whether proxy-to-host security is enabled. When checked, the option to Only display the cipher suite for connection from the client to the security proxy does not display the cipher suite used for the connection between the proxy server and the end host. When the check box is cleared, both cipher suites are displayed. Note: The check box is available when a Security proxy is selected, and these three settings are checked:
|