Select the Strict host key checking check box to define that host keys are NOT saved to the host key directory upon connection, and a connection is automatically refused if the host key has changed.

Select the Accept unknown host keys check box to define that all host keys are accepted but not saved without prompting the user for acceptance.

Select the Always show host key prompt check box to define that the user will always be prompted for host key acceptance, even when the host key is known.

The host key options are disabled by default.

Select the Disable check box to prevent the use of a certificate revocation list (CRL). A CRL is used to check if any of the used server certificates have been revoked.

	Note
	Disabling CRL checking is a security risk and should be done for testing purposes only.

The OCSP Responder Service provides client applications a point of control for retrieving real-time information on the validity status of certificates using the Online Certificate Status Protocol (OCSP).

For the OCSP validation to succeed, both the end-entity (=Secure Shell server) certificate and the OCSP responder certificate must be issued by the same CA. If the certificate has an Authority Info Access extension with an OCSP Responder URL, it is only used if there are no configured OCSP responders. It is not used if any OCSP responders have been configured.

If an OCSP responder is defined in the configuration file or in the certificate, it is tried first; only if it fails, traditional CRL checking is tried, and if that fails, the certificate validation returns a failure.

Specifies whether the client will verify the server's hostname against the Subject Name or Subject Alternative Name (DNS Address) in the server's certificate.

If this check box is not selected, the fields in the server host certificate are not verified and the certificate is accepted based on validity period and CRL check only. Note that this is a possible security risk, as anyone with a certificate issued by the same trusted CA that issues the server host certificates can perform a man-in-the-middle attack on the server if a client has the endpoint identity check disabled.

This element defines whether the certificates are required to be compliant with the DoD PKI (US Department of Defense Public-Key Infrastructure).

Specify the default domain used in the end-point identity check. This is the default domain part of the remote system name and it is used if only the base part of the system name is available.

If the default domain is not specified, the end-point identity check fails, for example, when a user tries to connect to a host "tower" giving only the short hostname and the certificate contains the full DNS address "tower.example.com".

Specify the HTTP proxy used when making LDAP or OCSP queries for certificate validity.

The format of the address is "http://username@proxy_server:port/network/netmask,network/netmask... ". The network/netmask part is optional and defines the network(s) that are connected directly (without the proxy).

Specify the SOCKS server used when making LDAP or OCSP queries for certificate validity.

The format of the address is "socks://username@socks_server:port/network/netmask,network/netmask... ". The network/netmask part is optional and defines the network(s) that are connected directly (without the SOCKS server).