To create a new communication process, click
* NEW COMMS SERVER.
To view the listeners associated with a communications process, click the communications process in the communications process
list.
To display all the configurable properties of the communication process, click
CONFIGURE.
- Auto Start
- Check this to automatically start the communications process when the enterprise server instance starts.
- STATUS
- Displays the current status of the communications process:
- Started
- Stopped
- Disabled
- Blocked
- Not Responding - This means any listener whose status is unknown because the server it is registered with is not responding
to the server monitor.
- Not Started - This means any listener with a status other than Started.
- Not Stopped - This means any listener with a status other than Stopped.
- PROCESS ID
- Displays the process ID of this communications process.
- ACTUAL ADDRESS
- Displays the network address used by the communications process to accept incoming client requests. The format is:
protocol:ip-address:port
where:
- protocol
- Can be tcp or tcpssl.
- ip-address
- This is either the text host name or IP address of the server communications process. An asterisk (*) indicates that the address
is dynamically assigned for the communications process when it starts.
- port
- The port number accepting incoming client requests.
- STATUS LOG
- Displays most recent event for that communications server.
CONFIGURE
- Protocol
- Protocol can be tcp or tcpssl.
- Requested Endpoint
- Specify the network address used by the listener to accept incoming client requests.
- Custom Configuration
- Specify optional textual configuration information.
TLS SETTINGS
For an enterprise server instance, you can create a secure Communications Process control listener to encrypt the communications
it handles. To do this, click TLS SETTINGS, this expands the TLS Settings group.
You must specify the following fields:
- Enable TLS
- Enables Transport Layer Security (TLS) for this communications process.
- Certificate File
- The location, on disk, of the certificate. If multiple certificates are used, separate the paths with a semicolon ';'.
- Keyfile
- The location, on disk, of the keyfile. If multiple keyfiles are used, separate the paths with a semicolon ';'.
- Server CA Root Certificate File
- The location, on disk, of the server root certificate.
Note: The following certificate file formats are supported DER, CER, PKCS #7, PKCS #8, PKCS #12 and PEM and following key file formats
PKCS #8, PKCS #12 and PEM.
ADVANCED TLS SETTINGS
Optionally, click
ADVANCED to expand the advanced group of options:
- Client Authentication
-
- Accept all clients
- Allow all clients to communicate with the server without being checked for a TLS/SSL certificate.
- Request client certificate, and verify if present
- Requests the client for a certificate, and to verify the returned certificate. If the client does not return a certificate,
communication continues between the client and server. If a certificate is returned and it fails to verify, communication
stops.
Note: If you select this, you must specify the CA root certificates file.
- Require client certificate, and verify
- Always require a client certificate and to verify it. This ensures that the client is trusted. If a certificate is not returned
or it cannot be verified, communication between the client and server is stopped.
Note: If you select this, you must specify the CA root certificates file.
- Honor Server Cipher List
- By default, the TLS Honor Server Cipher List is checked. This forces clients to use the protocols and cipher suites specified
in order of their priority.
- Protocols
- The list of TLS protocols to be used, in order of precedence. Each specified protocol is preceded by one of the following
operators:
- !
- Exclude. Permanently exclude the protocol and ignore any subsequent attempt to add the protocol back in.
- +
- Add. Add the protocol to the existing collection.
- -
- Delete. Delete the protocol from the existing collection.
For example, to only use TLS1.1 and TLS1.2, type
-ALL+TLS1.1+TLS1.2
Note: The
Protocols field now supports TLS1.3.
- Cipher Suites
- Specifies the priority of cipher suites to be used. The cipher suite priority is formed using a combination of keywords and
keyword modifiers for a space-separated string:
- !
- Exclude. Permanently exclude the cipher suite and ignore any subsequent attempt to add the cipher suite back in.
- +
- Add. Add the cipher suite to the end of the collection.
- -
- Delete. Delete the cipher suite from the existing collection.
By default, the following cipher suite list is used:
kEECDH+ECDSA kEECDH kEDH HIGH MEDIUM +3DES +SHA !RC4 !aNULL !eNULL !LOW !MD5 !EXP
- TLS1.3 Cipher Suites
- The list of cipher suites to be used with TLS1.3 separated by a colon ':'. For example:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
- Diffie-Hellman Minimum Group Size
- Specifies the size in bits of the modulus length of the Diffie-Hellman group.
Note: Micro Focus recommends a minimum modulus size of 2048 bits.
- Key Exchange Cipher Groups
- The key exchange cipher groups to be used, separated by semicolons ';'.
For example:
secp521r1;secp384r1;prime256v1;secp256k1;secp224r1;secp224k1;prime192v1
- TLS1.3 Middlebox Compatibility
- Enables workaround for TLS1.3 on networks with incompatible middleboxes, for example, routers and firewalls. Disabling this
can improve performance on compatible networks but might result in dropped connections otherwise.