Connecting to z/OS Using SSL and Reflection for IBM

This technical note describes how to set up Reflection for IBM to connect over SSL-enabled Telnet to z/OS utilizing a self-signed certificate.

Important: The security for Reflection depends upon the security of the operating system, host, and network environment. We strongly recommend that you evaluate and implement all relevant security service packs, updates, and patches recommended by your operating system, host, and network manufacturers.

The recommendations in this note are general guidelines and should be evaluated in the context of your own computing needs and environment. These general steps can also be used to configure Reflection to utilize a registered digital signature and key pair (from a certifying authority); however, it is recommended that you configure and test your SSL environment using a self-signed certificate before implementing a production certificate from a certificate authority.

Setting up Reflection for IBM to connect to a z/OS mainframe over SSL involves these steps:

1. Configure the Mainframe for SSL
2. Verify that the Mainframe is Configured to Support SSL
3. Create a Self-Signed Certificate for the Server
4. Transfer or Extract the Certificate
5. Optional: Create a Client Certificate
6. Make a Connection

Note the following:

• Once you have fully tested the SSL/TLS support, you can repeat steps 3 and 4 using a Certificate Authority (CA) signed certificate.
• Reflection's SSL/TLS support requires that Microsoft Internet Explorer be installed on the client machine. It need not be the primary browser, but Internet Explorer must be installed and configured to be able to manage and use the certificate.

Configure the Mainframe for SSL

The working TCP/IP profile dataset on the z/OS mainframe must be configured to support SSL connections. This process varies depending on the operating system and version. For detailed setup instructions, refer to the IBM publications, "z/OS IBM Communications Server IP Configuration Reference" and “z/OS Communications Server IP Configuration Guide” for the version of z/OS you are using at http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi.

During the configuration process, you must define a secure port and key database reference for the TCP/IP SSL connection and add an entry to the VTAM parameters.

The following is a generic example of a TCPIP.PROFILE.TCPIP dataset. (Use this example only as a guide when configuring your dataset.)

Verify that the Mainframe is Configured to Support SSL

To engage the updates to the TCP/IP profile dataset, cycle the z/OS TCP/IP stack. Once you have done this, you will be able to see that the port you have configured for the secure connections is listening.

Execute the Display Telnet PROFILE command to verify that the port is up and attached to the proper key database.

Sample display:

Create a Self-Signed Certificate for the Server

Security certificates (also known as server certificates, site certificates, digital certificates, or SSL certificates) are used as part of the authentication process. Certificates are either self-signed or signed by a Certificate Authority (CA).

There are numerous ways to create a self-signed server certificate, such as using the RACDCERT or RACF commands, or the Gskkyman utility (which runs under UNIX System Services). Refer to IBM’s documentation for information on using these commands or utilities (http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/pbi.cgi).

Note the following:

• While creating the certificate, enter the fully-qualified host name in the Common Name field of the certificate.
• If you plan to implement client authentication, you must also create a client certificate.
• The administrator must maintain physical security of the management server and proxy server. That is, no one other than the administrator should be able to physically access the servers, and no unauthorized individuals should be able to access the key store folders on the server. The security of the servers is important to prevent compromise of the certificates.

Once you have created the self-signed server certificate, save it to a file, transfer the file to the end user's computer, and import the certificate into Internet Explorer's Certificate Store.

Transfer or Extract the Certificate

Using an FTP client (such as the Reflection or Microsoft Windows FTP clients), transfer the self-signed certificate file to the client computer, and then follow these steps to integrate it with Internet Explorer:

1. Click Start > Control Panel > Internet Options.
2. On the Content tab, click Certificates.
3. On the Trusted Root Certification Authorities tab, click Import > Next.
4. Click Browse. Browse for and select your self-signed certificate file; click Open.
5. Click Next, and then click Finish.
6. When asked, "Do you want to ADD the following certificate to the Root Store," click Yes.

The new certificate is displayed in the Trusted Root Certification Authorities list.

Create a Client Certificate

Client certificates are not required to establish SSL connections using Reflection for IBM. However, if client certificates are required in your network environment, see KB 7021686, which describes how to create and import a client certificate for use connecting to a z/OS mainframe using SSL and Reflection for IBM.

Make a Connection

To make an SSL connection using Reflection:

1. Start Reflection for IBM.
2. Click Connection > Session Setup.
3. In the Type drop-down, select IBM 3270 Terminal.
4. In the Host name or IP address field, enter the name of your mainframe as it appears in the Common Name field of the self-signed certificate. Typically, this is the fully qualified host name.
5. In the Port field, enter the mainframe's secure port number (23001 in the earlier example).
6. Click Security.
7. On the SSL/TLS tab, select Use SSL/TLS security.

8. Click OK, and then click Connect.

Once you have successfully connected, a blue and gray padlock icon is displayed in the OIA line indicating that your connection is secure.

Legacy KB ID

This document was originally published as Attachmate Technical Note 1744.