Under Server Authentication, you can define server authentication settings as described in Managing Host Keys, Managing CA Certificates, and Managing LDAP Server Settings.
On the Host Keys page, you can view and manage the known public host keys used in server authentication.
You can check if a public host key of a server exists on your client, and view it's fingerprint. To check the host key, enter the name of the server in the Host field and the listener port number in the Port field, and click Check. Note that wildcard characters are not allowed.
The following kind of a window appears and shows the host key location and the fingerprint of the public key in the SSH Babble format, consisting of a series of pronounceable five-letter words in lower case and separated by dashes.
For more information on server host keys, see Server Authentication with Public Keys.
Click the Add User Key button to add new host keys to your own user-specific host key directory. Use the Add Global Key button to add new host keys to the directory common to all users on your computer. The Connection Broker opens a file manager view where you can browse to the appropriate location and select the key you want to copy to the host key directory.
In case you want to delete the public key of a Server, enter the name of the Server in the Host field and the listener port number in the Port field, and click Delete.
A dialog box appears asking you to confirm or to cancel the deleting of the host key.
Select the Strict host key checking check box to define that host keys are NOT saved to the host key directory upon connection, and a connection is automatically refused if the host key has changed.
Select the Accept unknown host keys check box to define that all host keys are accepted but not saved without prompting the user for acceptance.
Select the Always show host key prompt check box to define that the user will always be prompted for host key acceptance, even when the host key is known.
The host key options are disabled by default.
On the Certificates page, you can manage trusted CA certficates.
For more information on server certificate authentication, see Server Authentication with Certificates.
The following fields are displayed on the CA certificate list:
Issued to: The certification authority to whom the certificate has been issued.
Issued by: The entity who has issued the CA certificate.
Expiration date: The date that the CA certificate will expire.
Filename: The file containing the CA certificate.
Select the Disable check box to prevent the use of a certificate revocation list (CRL). A CRL is used to check if any of the used server certificates have been revoked.
Note | |
---|---|
Disabling CRL checking is a security risk and should be done for testing purposes only. |
The OCSP Responder Service provides client applications a point of control for retrieving real-time information on the validity status of certificates using the Online Certificate Status Protocol (OCSP).
For the OCSP validation to succeed, both the end-entity (=Secure Shell server) certificate
and the OCSP responder certificate must be issued by the same CA. If the
certificate has an Authority Info Access
extension with an OCSP
Responder URL, it is only used if there are no configured OCSP responders.
It is not used if any OCSP responders have been configured.
If an OCSP responder is defined in the configuration file or in the certificate, it is tried first; only if it fails, traditional CRL checking is tried, and if that fails, the certificate validation returns a failure.
Specifies whether the client will verify the server's hostname against the Subject Name or Subject Alternative Name (DNS Address) in the server's certificate.
If this check box is not selected, the fields in the server host certificate are not verified and the certificate is accepted based on validity period and CRL check only. Note that this is a possible security risk, as anyone with a certificate issued by the same trusted CA that issues the server host certificates can perform a man-in-the-middle attack on the server if a client has the endpoint identity check disabled.
This element defines whether the certificates are required to be compliant with the DoD PKI (US Department of Defense Public-Key Infrastructure).
Specify the default domain used in the end-point identity check. This is the default domain part of the remote system name and it is used if only the base part of the system name is available.
If the default domain is not specified, the end-point identity check
fails, for example, when a user tries to connect to a host
"tower
" giving only the short hostname and the certificate
contains the full DNS address "tower.example.com
".
Specify the HTTP proxy used when making LDAP or OCSP queries for certificate validity.
The format of the address is
"http://username@proxy_server:port/network/netmask,network/netmask... "
.
The network/netmask
part is optional and defines the
network(s) that are connected directly (without the proxy).
Specify the SOCKS server used when making LDAP or OCSP queries for certificate validity.
The format of the address is
"socks://username@socks_server:port/network/netmask,network/netmask... "
.
The network/netmask
part is optional and defines the
network(s) that are connected directly (without the SOCKS server).
On the LDAP Servers page, you can define LDAP servers used for fetching CRLs and/or subordinate CA certificates based on the issuer name of the certificate being validated.
CRLs are automatically retrieved from the CRL distribution point defined in the certificate to be verified if the point exists.
To add an LDAP server, click the Add... button. Define the hostname and port for the server.
To edit an LDAP server, select the server from the list and click Edit.
To delete an LDAP server, select the server from the list and click Delete.
On the CRL Prefetch page, you can define certificate revocation lists (CRLs) to be fetched from the defined location at regular intervals. The CRL distribution point can be either a standard format LDAP or HTTP URL, or it can refer to a file. The file format must be either binary DER or base64, PEM is not supported. Enter the file URL in this format:
file:///absolute/path/name
CRLs are automatically retrieved from the CRL distribution point defined in the certificate to be verified if the point exists.
To add a CRL prefetch address, click Add.... The CRL Prefetch dialog box opens.
Enter the URL of the CRL distribution point and the
Interval how often the CRL is downloaded and click
OK. The default download interval is 3600
(seconds).
To edit an existing CRL prefetch setting, select the setting from the list and click Edit.
To delete an an existing CRL prefetch setting, select the setting from the list and click Delete.