RE: CAE with/with out SSL.

[Neil Palmer <neilp@xxxxxxxxxxx>]

A couple of good references:

This goes through the host system tasks of creating certificate authority,
certificates, and assigning them to application (Telnet).
http://www-912.ibm.com/s_dir/SLKBase.nsf/1ac66549a21402188625680b0002037e/ab0c7f46c3d722868625681d005229c8?OpenDocument&Highlight=0,17615517

Chapter 4 in this Redbook seems a good summary of Client Access (PC side)
of SSL setup.

http://publib-b.boulder.ibm.com/Redbooks.nsf/9445fa5b416f6e32852569ae006bb65f/17958ddeba0f51ab85256730006360f5

Chapter 4.  Secure Sockets Layer . . . . . . . . . . . . . . . . . . . . . . . 
. . . . . . . . .  79
4.1  Introduction to SSL  . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . .  79
4.2  AS/400 Requirements for SSL . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . .  81
4.3  Installing SSL on the Client PC . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . .  82
4.4  Downloading the Digital Certificate  . . . . . . . . . . . . . . . .
. . . . . . . . . . . . .  85
4.5  Managing Certificates on Your PC . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . .  90
4.6  Using SSL with Client Access Express for Windows  . . . . . . . . . .
. . . . . .  94
      4.6.1  Enabling SSL for Operations Navigator . . . . . . . . . . . . . . .
. . . . . . .  95
      4.6.2  Enabling SSL for PC5250 Sessions . . . . . . . . . . . . . .
. . . . . . . . . . .  96
      4.6.3  Enabling SSL for Data Transfer . . . . . . . . . . . . . . .
. . . . . . . . . . . . .  97
      4.6.4  Enabling SSL for ODBC. . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . .  99
4.7  IBM eNetwork Communication Suite V4.3 Coexistence Considerations .
100


...Neil





>Sean,
>
>I think DCM is what you were thinking of.

No, there is a command line program you can run that toggles the telnet
server to accept secure connections only from users presenting valid
certificates.  It affects new connections and will not kill off current
connections.

I haven't figured out how to get any client to present a valid certificate
yet, though.