RE: Telnet-SSL

[Chris Bipes <chris.bipes@xxxxxxxxxxxxxxx>]

Client will not do VPN to us.  I have no control over their network.  Our
Sales VP have not been able to convince them that VPN is better.  Besides
they only need TN5250, no other services from our network.  SSL works great
for that but I want to lock it down further by using Digital Certificates.  

This works GREAT!

SSL client authentication is toggled ON or OFF using a service program
(QTVSRV in library QSYS) to toggle the desired authentication state. When
SSL client authentication is ON, the i400 Telnet server will authenticate
client certificates for Telnet clients connecting on the SSL ("telnet-ssl")
port. Telnet clients (printer or display) that do not send a valid client
certificate when connecting on this port will fail to establish a session. 

This support mechanism requires a System Administrator (or other user with
*SECADM and *ALLOBJ special authorities) to toggle the state using the
supplied service tool. 

The System Administration can turn ON client authentication by issuing the
following CL commands: 

CALL PGM(QSYS/QTVSRV) PARM(*SSLCERT) 
ENDTCPSVR SERVER(*TELNET) 
STRTCPSVR SERVER(*TELNET) 

-----Original Message-----
From: Fritz Hayes [mailto:fhayes@xxxxxxxxxxx]
Sent: Thursday, May 29, 2003 1:26 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Telnet-SSL


Why not use client (BP) to server (iSeries) VPN?