R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

914
Configuring an SSL client policy
An SSL client policy is a set of SSL parameters for a client to use when connecting to the server. An SSL
client policy takes effect only after it is associated with an application layer protocol.
If the SSL server is configured to authenticate the SSL client, you must configure the PKI domain for the SSL
client policy to use to obtain the certificate of the client. For more information about PKI domain
configuration, see VPN Configuration Guide.
To configure an SSL client policy:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Create an SSL client policy
and enter its view.
ssl client-policy policy-name N/A
3. Specify a PKI domain for the
SSL client policy.
pki-domain domain-name
Optional.
No PKI domain is configured by
default.
If the SSL server requires
certificate-based authentication for
SSL clients, you must use this
command to specify a PKI domain
for the client and request a local
certificate for the client through the
PKI domain.
4. Specify the preferred cipher
suite for the SSL client policy.
• In non-FIPS mode:
prefer-cipher
{ dhe_rsa_aes_128_cbc_sha |
dhe_rsa_aes_256_cbc_sha |
rsa_3des_ede_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha |
rsa_des_cbc_sha |
rsa_rc4_128_md5 |
rsa_rc4_128_sha
• In FIPS mode:
prefer-cipher
{ dhe_rsa_aes_128_cbc_sha |
dhe_rsa_aes_256_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha }
Optional.
rsa_rc4_128_md5 by default.
Support for the commands
depends on the firewall model. For
more information, see the SSL
command reference.
5. Specify the SSL protocol
version for the SSL client
policy.
version { ssl3.0 | tls1.0 }
Optional.
TLS 1.0 by default.
6. Enable the SSL client to
perform certificate-based
authentication for the SSL
server.
server-verify enable
Optional.
Enabled by default.