Партнёры:
Хостинг:
ksslcfg - enable and configure SMF instance of Kernel SSL
ksslcfg create -f pkcs11 -T token_label -C certificate_label
[-d softtoken_directory]
[-p password_file [-u username]]
[-h ca_certchain_file] [-c ciphersuites]
[-t ssl_session_cache_timeout]
[-z ssl_session_cache_size] [-v] -x proxy_port [host] ssl_port
ksslcfg create -f pkcs12 -i cert_and_key_pk12file
[-p password_file [-u username]]
[-c ciphersuites] [-t ssl_session_cache_timeout]
[-z ssl_session_cache_size] [-v] -x proxy_port [host] ssl_port
ksslcfg create -f pem -i cert_and_key_pemfile
[-p password_file [-u username]]
[-c ciphersuites] [-t ssl_session_cache_timeout]
[-z ssl_session_cache_size] [-v] -x proxy_port [host] ssl_port
ksslcfg delete [-v] [host] ssl_port
ksslcfg -V
ksslcfg -?
ksslcfg manages smf(5) instances for the Kernel SSL proxy module. An SSL-enabled web server can use the services of its Kernel SSL proxy to improve the performance of the HTTPS packets processing. It does so by creating an instance of the Kernel SSL service, specifying the SSL proxy port and parameters, and by listening on the proxy port.
The create subcommand creates an instance and enables the service for the given address and SSL port.
The delete subcommand disables the service for the given address and port, if it is enabled, and deletes the instance from the SMF repository.
ksslcfg can be run as root or by other users assigned to the Network Security profile. See rbac(5) and user_attr(4). You must run ksslcfg to configure your Kernel SSL proxy before you start your application.
ksslcfg allows you to specify an ssl_port operand, described under OPERANDS, and, with the -x option, a proxy_port value. When specified for use with the Kernel SSL proxy, these values cannot also be configured for the Solaris Network Cache and Acceleration (NCA) feature. See nca(1) for a description of the NCA feature.
The Fault Managed Resource Identifier (FMRI) for the kernel SSL proxy instances is svc://network/ssl/proxy. ksslcfg creates an instance of that service unique to the combination of host and SSL port. Instance FMRIs for particular proxy entries can be found with svcs(1) and used for dependencies of other services.
The following options are supported:
-c ciphersuites
rsa_rc4_128_sha rsa_rc4_128_md5 rsa_aes_256_cbc_sha rsa_aes_128_cbc_sha rsa_3des_ede_cbc_sha rsa_des_cbc_sha
-f key_format
-i key_and_certificate_file
-C certificate_label
-d softtoken_directory
-h ca_certchain_file
-p password_file
-t ssl_session_cache_timeout
-T token_label
-u username
-v
-V
-x proxy_port
-z ssl_session_cache_size
-?
[host] [ssl_port]
Example 1 Create and Enable a Kernel SSL Instance
The following command creates and enables a Kernel SSL instance using a certificate and a key in PKCS#11 format.
# ksslcfg create -f pkcs11 -T "Sun Software PKCS#11 softtoken" \ -C "Server-Cert" -p /some/directory/password -u webservd \ -x 8080 www.mysite.com 443 % svcs svc:/network/ssl/proxy STATE STIME FMRI online Sep_27 svc:/network/ssl/proxy:kssl-www-mysite-com-443
Example 2 Create and Enable a Default Instance for All Addresses
The following command creates and enables a default instance for all addresses from a certicate and key in a pkcs#12 file.
# ksslcfg create -x 8888 -f pkcs12 -i /some/directory/keypair.p12 \ -p /some/directory/password -u webservd 443
Example 3 Create and Enable an Instance with Specific Cipher Suites
The following command creates and enables an instance with specific cipher suites.
# ksslcfg create -x 8080 -f pem \ -i /some/directory/keypair.pem -p /some/directory/password \ -c "rsa_rc4_128_md5,rsa_rc4_128_sha" \ 209.249.116.195 443
Example 4 Disable and Delete an Instance
The following command disables and deletes an instance.
# ksslcfg delete www.mysite.com 443
0
>0
See attributes(5) for descriptions of the following attributes:
| |||||||||
Command line options are Evolving; command output is Unstable. The FMRI service name (svc://network/ssl/proxy) is Unstable, as is the FMRI instance's name format. The utility name is Stable.
nca(1), svcprop(1), svcs(1), cryptoadm(1M), svcadm(1M), svccfg(1M), user_attr(4), attributes(5), pkcs11_softtoken(5), rbac(5), smf(5)
ksslcfg create without an host argument creates an INADDR_ANY smf instance. ksslcfg delete without an host argument deletes only the INADDR_ANY instance. ksslcfg delete needs a host argument to delete any non-INADDR_ANY instance.
On a system with zones(5) installed, the ksslcfg command can be used only in the global zone at this time.
|
Закладки на сайте Проследить за страницей |
Created 1996-2024 by Maxim Chirkov Добавить, Поддержать, Вебмастеру |