<!DOCTYPE REFENTRY PUBLIC "-//Sun Microsystems//DTD DocBook V3.0-Based SolBook Subset V2.0//EN" [
<!--ArborText, Inc., 1988-1999, v.4002-->
<!ENTITY metainfo SYSTEM "metainfo.sgm">
<!ENTITY options-common SYSTEM "options-common.sgm">
<!ENTITY synopsis-common SYSTEM "synopsis-common.sgm">
<!ENTITY sjsas "Sun Java System Application Server">
<!ENTITY % commonents SYSTEM "smancommon.ent">
%commonents;
<!ENTITY % booktitles SYSTEM "booktitles.ent">
%booktitles;
<!ENTITY Dash "&ndash;">
]>
<?Pub UDT _bookmark _target>
<?Pub EntList brvbar bull cross dash diam diams frac12 frac13 frac14 hellip
 laquo lArr loz mdash nabla ndash para pound rArr raquo sect yen ne>
<?Pub Inc>
<refentry id="create-ssl-1">
<refmeta><refentrytitle>create-ssl</refentrytitle><manvolnum>1</manvolnum>&metainfo;
</refmeta>
<refnamediv><indexterm><primary sortas="create-ssl">create-ssl &mdash; creates
and configures the SSL element in the selected HTTP listener, IIOP listener,
or IIOP service</primary></indexterm><indexterm><primary sortas="creates and configures the SSL element in the selected HTTP listener, IIOP listener, or IIOP service">
creates and configures the SSL element in the selected HTTP listener, IIOP
listener, or IIOP service &mdash; create-ssl</primary></indexterm><refname>
create-ssl</refname><refpurpose>creates and configures the SSL element in
the selected HTTP listener, IIOP listener, or IIOP service</refpurpose></refnamediv>
<refsynopsisdiv><title>&synp-tt;</title>
<cmdsynopsis><command>create-ssl</command>&synopsis-common;
<arg>&Dash;&Dash;target <replaceable>target</replaceable></arg><arg choice="plain">
 &Dash;&Dash;type <replaceable>listener_or_service_type</replaceable> </arg>
<arg choice="plain">&Dash;&Dash;certname <replaceable>cert_name</replaceable> 
</arg><arg>&Dash;&Dash;ssl2enabled=<replaceable>false </replaceable> </arg>
<arg>&Dash;&Dash;ssl2ciphers <replaceable>ss12ciphers</replaceable> </arg>
<arg>&Dash;&Dash;ssl3enabled=<replaceable>true </replaceable></arg><arg>&Dash;&Dash;tlsenabled=<replaceable>
true </replaceable></arg><arg>&Dash;&Dash;ssl3tlsciphers <replaceable>ssl3tlsciphers
</replaceable> </arg><arg>&Dash;&Dash;tlsrollbackenabled=<replaceable>true
</replaceable> </arg><arg>&Dash;&Dash;clientauthenabled=<replaceable>false 
</replaceable> </arg><arg choice="opt"><replaceable>listener_id</replaceable></arg>
</cmdsynopsis></refsynopsisdiv>
<refsect1><title>&desc-tt;</title>
<para>Creates and configures the SSL element in the selected HTTP listener,
IIOP listener, or IIOP service to enable secure communication on that listener/service.
</para>
<para>This command is supported in remote mode only.</para>
</refsect1>
<refsect1><title>&opts-tt;</title>
<para>If an option has a short option name, then the short option preceeds
the long option name. Short options have one dash whereas long options have
two dashes.</para>
<variablelist termlength="medium">&options-common;
<varlistentry><term><option role="nodash">&Dash;&Dash;target </option></term>
<listitem><para>In Enterprise Edition, specifies the target on which you are
configuring the ssl element. The following values are valid: <itemizedlist>
<listitem><para><literal>server</literal>, the server in which the iiop-service
or HTTP/IIOP listener is to be configured for SSL.</para>
</listitem>
<listitem><para><replaceable>config</replaceable>, the configuration that
contains the HTTP/IIOP listener or iiop-service for which SSL is to be configured.
</para>
</listitem>
<listitem><para><replaceable>cluster</replaceable>, the cluster in which the
HTTP/IIOP listener or iiop-service is to be configured for SSL. All the server
instances in the cluster will get the SSL configuration for the respective
listener or iiop-service.</para>
</listitem>
<listitem><para><replaceable>instance</replaceable>, the instance in which
the HTTP/IIOP listener or iiop-service is to be configured for SSL.</para>
</listitem>
</itemizedlist></para>
</listitem></varlistentry>
</variablelist></refsect1>
<refsect1><title>OPTIONAL ATTRIBUTES</title>
<para>The following optional attribute name/value pairs are available:</para>
<informaltable frame="all" orient="port">
<tgroup cols="2" align="left">
<?PubTbl tgroup dispwid="9.17in">
<colspec colname="col1" colwidth="0.68*"><colspec colname="col2" colwidth="1.32*">
<thead>
<row><entry valign="top"><para> Property</para></entry><entry valign="top"><para>
Definition</para></entry></row>
</thead>
<tbody>
<row><entry colname="col1"><para>type</para></entry><entry colname="col2"><para>
The type of service or listener for which the SSL is created. The type can
be <replaceable>http-listener</replaceable>, <replaceable>iiop-listener</replaceable>,
or <replaceable>iiop-service</replaceable>. When the type is <replaceable>
iiop-service</replaceable>, the<literal> ssl-client-config</literal> along
with the embedded ssl element is created in domain.xml.</para></entry></row>
<row><entry colname="col1"><para>certname</para></entry><entry colname="col2"><para>
The nickname of the server certificate in the certificate database or the
PKCS#11 token. The format of the name in the certificate is <replaceable>
tokenname:nickname</replaceable>. For this property, the <replaceable>tokenname:
</replaceable> is optional.</para></entry></row>
<row><entry colname="col1"><para>ssl2enabled</para></entry><entry colname="col2"><para>
Set this property to <replaceable>true</replaceable> to enable SSL2. The default
value is <replaceable>false</replaceable>. If both SSL2 and SSL3 are enabled
for a virtual server, the server tries SSL3 encryption first. In the event
SSL3 encryption fails, the server then tries SSL2 encryption.</para></entry>
</row>
<row><entry colname="col1"><para>ssl2ciphers</para></entry><entry colname="col2"><para>
A comma-separated list of the SSL2 ciphers to be used. Use the prefix <command>
+</command> to enable or <command>&mdash;</command> to disable a particular
cipher. Allowed values are: <replaceable>rc4</replaceable>, <replaceable>
rc4export</replaceable>, <replaceable>rc2</replaceable>, <replaceable>rc2export
</replaceable>, <replaceable>idea</replaceable>, <replaceable>des</replaceable>,
and <replaceable>desede3</replaceable>. If no value is specified, all supported
ciphers are assumed to be enabled.</para></entry></row>
<row><entry colname="col1"><para>ssl3enabled</para></entry><entry colname="col2"><para>
Set this property to <replaceable>false</replaceable> to disable SSL3. The
default value is <replaceable>true</replaceable>. If both SSL2 and SSL3 are
enabled for a virtual server, the server tries SSL3 encryption first. In the
event SSL3 encryption fails, the server then tries SSL2 encryption.</para></entry>
</row>
<row><entry colname="col1"><para>tlsenabled</para></entry><entry colname="col2"><para>
Set this property to <replaceable>false</replaceable> to disable TLS. The
default value is <replaceable>true</replaceable> It is good practice to enable
TLS, which is a more secure version of SSL.</para></entry></row>
<row><entry colname="col1"><para>ssl3tlsciphers</para></entry><entry colname="col2"><para>
A comma-separated list of the SSL3 and/or TLS ciphers to be used. Use the
prefix <command>+</command> to enable or <command>&mdash;</command> to disable
a particular cipher. Allowed values are <replaceable>SSL_RSA_WITH_RC4_128_MD5
</replaceable>, <replaceable>SSL_RSA_WITH_3DES_EDE_CBC_SHA</replaceable>, <replaceable></replaceable>, <replaceable>
SSL_RSA_WITH_DES_CBC_SHA</replaceable>, <replaceable>SSL_RSA_EXPORT_WITH_RC4_40_MD5
</replaceable>, <replaceable>SSL_RSA_WITH_NULL_MD5</replaceable>,<replaceable>
SSL_RSA_WITH_RC4_128_SHA</replaceable>, and <replaceable>SSL_RSA_WITH_NULL_SHA
</replaceable>. If no value is specified, all supported ciphers are assumed
to be enabled.</para></entry></row>
<row><entry colname="col1"><para>tlsrollbackenabled</para></entry><entry colname="col2"><para>
Set to <replaceable>true</replaceable> (default) to enable TLS rollback. TLS
rollback should be enabled for Microsoft Internet <?Pub Caret>Explorer 5.0
and 5.5. This option is only valid in the Enterprise Edition. This option
is only valid when <option role="nodash">tlsenabled</option>=<replaceable>
true</replaceable>.</para></entry></row>
<row><entry colname="col1"><para>clientauthenabled</para></entry><entry colname="col2"><para>
Set to <replaceable>true</replaceable> if you want  SSL3 client authentication
performed on every request independent of ACL-based access control. Default
value is <replaceable>false</replaceable>. </para></entry></row>
</tbody>
</tgroup>
</informaltable>
</refsect1>
<refsect1><title>&oper-tt;</title>
<variablelist termlength="medium">
<varlistentry><term><replaceable>listener_id </replaceable></term><listitem>
<para> The ID of the HTTP or IIOP listener for which the SSL element is to
be created. The <replaceable>listener_id</replaceable> is not required if
the &Dash;&Dash;<literal>type</literal> is <replaceable>iiop-service</replaceable>.
</para>
</listitem></varlistentry>
</variablelist></refsect1>
<refsect1><title>&exam-tt;</title>
<example>
<title>Using create-ssl</title>
<para>The following example shows how to create an SSL element for an HTTP
listener named <replaceable>http-listener-1</replaceable>.</para>
<screen>asadmin> <userinput>create-ssl --user admin --host fuyako --port 7070 
--passwordfile adminpassword.txt --type http-listener --certname sampleCert http-listener-1
</userinput>
Command create-ssl executed successfully.</screen>
</example>
</refsect1>
<refsect1><title>&exit-tt;</title>
<variablelist termlength="medium">
<varlistentry><term>0</term><listitem><para> command executed successfully
</para>
</listitem></varlistentry>
<varlistentry><term>1 </term><listitem><para>error in executing the command
</para>
</listitem></varlistentry>
</variablelist></refsect1>
<refsect1><title>&also-tt;</title>
<para><link linkend="delete-ssl-1"><citerefentry><refentrytitle>delete-ssl
</refentrytitle><manvolnum>1</manvolnum></citerefentry></link></para>
</refsect1>
</refentry>
<?Pub *0000010062>
