<!--Arbortext, Inc., 1988-2008, v.4002-->
<!DOCTYPE REFENTRY PUBLIC "-//Sun Microsystems//DTD SolBook 3.5//EN" [
<!ENTITY options-common SYSTEM "options-common.sgm">
<!ENTITY synopsis-common SYSTEM "synopsis-common.sgm">
<!ENTITY % commonents SYSTEM "common.ent">
%commonents;
]>
<?Pub UDT _bookmark _target>
<?Pub EntList bull rArr sect>
<?Pub Inc>
<refentry id="create-ssl-1"><?Pub Tag atict:info tracking="off" ref="2"><?Pub Tag
atict:user user="hl34125" fullname=""><?Pub Tag atict:user user="pmdavies"
fullname=""><?Pub Tag atict:user user="ah95648" fullname="">
<!-- @(#)create-ssl.1 1.10 07/07/13 SMI; -->
<refmeta><refentrytitle>create-ssl</refentrytitle><manvolnum>1</manvolnum>
<refmiscinfo class="date">20th Feb 2008</refmiscinfo>
<refmiscinfo class="sectdesc">&man1;</refmiscinfo>
<refmiscinfo class="software">&software;</refmiscinfo>
<refmiscinfo class="arch">generic</refmiscinfo>
<refmiscinfo class="copyright">Copyright (c) 2008, Sun Microsystems, Inc.
All Rights Reserved</refmiscinfo>
</refmeta>
<refnamediv><indexterm><primary>create-ssl</primary></indexterm><indexterm>
<primary>creates and configures the SSL element in the selected HTTP listener,
IIOP listener, or IIOP service</primary></indexterm>
<refname>create-ssl</refname><refpurpose>creates and configures the SSL element
in the selected HTTP listener, IIOP listener, or IIOP service</refpurpose>
</refnamediv>
<refsynopsisdiv><title></title>
<synopsis><command>create-ssl</command> &synopsis-common; [<option
role="double-dash">target</option> <replaceable>target</replaceable>]
  <option role="double-dash">type</option> <replaceable>listener_or_service_type</replaceable>  <option
role="double-dash">certname</option> <replaceable>cert_name</replaceable> 
 [<option role="double-dash">ssl</option>2enabled=<replaceable>false </replaceable> ] [<option
role="double-dash">ssl</option>2ciphers <replaceable>ss12ciphers</replaceable> ]
 [<option role="double-dash">ssl</option>3enabled=<replaceable>true </replaceable>] [<option
role="double-dash">tlsenabled</option>=<replaceable>true </replaceable>]
 [<option role="double-dash">ssl</option>3tlsciphers <replaceable>ssl3tlsciphers</replaceable> ] [<option
role="double-dash">tlsrollbackenabled</option>=<replaceable>true</replaceable> ]
 [<option role="double-dash">lientauthenabled</option>=<replaceable>false </replaceable> ] [<replaceable>
listener_id</replaceable>]</synopsis>
</refsynopsisdiv>
<refsect1 role="description"><title></title>
<para>Creates and configures the SSL element in the selected SIP<?Pub Caret>
listener, HTTP listener, IIOP listener, or IIOP service to enable secure communication
on that listener/service.</para>
<para>This command is supported in remote mode only.</para>
</refsect1>
<refsect1 role="options"><title></title>
<variablelist termlength="medium">&options-common;
<varlistentry><term><option role="double-dash">target </option></term>
<listitem><para>Specifies the target on which you are configuring the SSL
element. The following values are valid: </para>
<itemizedlist>
<listitem><para><literal>server</literal>&hyphen; Specifies the default server
instance as the target for configuring the SSL element.  <literal>server</literal> is
the name of the default server instance and is the default value.</para>
</listitem>
<listitem><para><replaceable>config</replaceable>&hyphen; Specifies the configuration
that contains the HTTP/IIOP listener or IIOP-service for which SSL is to be
configured.</para></listitem>
<listitem><para><replaceable>cluster</replaceable>&hyphen; Specifies the cluster
in which the HTTP/IIOP listener or IIOP-service is to be configured for SSL.
All the server instances in the cluster will get the SSL configuration for
the respective listener or IIOP-service.</para></listitem>
<listitem><para><replaceable>instance</replaceable>&hyphen; Specifies the
 instance in which the HTTP/IIOP listener or IIOP-service is to be configured
for SSL.</para></listitem>
</itemizedlist>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">type</option></term>
<listitem><para>The type of service or listener for which the SSL is created.
The type can be <replaceable>http-listener</replaceable>, <replaceable>iiop-listener
</replaceable>, or <replaceable>iiop-service</replaceable>. When the type
is <replaceable>iiop-service</replaceable>, the<literal> ssl-client-config</literal> along
with the embedded SSL element is created in domain.xml.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">certname</option></term>
<listitem><para>The nickname of the server certificate in the certificate
database or the PKCS#11 token. The format of the name in the certificate is <replaceable>
tokenname:nickname</replaceable>. For this property, the <replaceable>tokenname:</replaceable> is
optional.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">ssl2enabled</option></term>
<listitem><para>Set this property to true to enable SSL2. The default value
is <replaceable>false</replaceable>. If both SSL2 and SSL3 are enabled for
a virtual server, the server tries SSL3 encryption first. In the event SSL3
encryption fails, the server then tries SSL2 encryption.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">ssl2ciphers</option></term>
<listitem><para>A comma-separated list of the SSL2 ciphers to be used. Use
the prefix <command>+</command> to enable or <command>&mdash;</command> to
disable a particular cipher. Allowed values are: <replaceable>rc4</replaceable>, <replaceable>
rc4export</replaceable>, <replaceable>rc2</replaceable>, <replaceable>rc2export</replaceable>, <replaceable>
idea</replaceable>, <replaceable>des</replaceable>, and <replaceable>desede3</replaceable>.
If no value is specified, all supported ciphers are assumed to be enabled.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">ssl3enabled</option></term>
<listitem><para>Set this property to <replaceable>false</replaceable> to disable
SSL3. The default value is <replaceable>true</replaceable>. If both SSL2 and
SSL3 are enabled for a virtual server, the server tries SSL3 encryption first.
In the event SSL3 encryption fails, the server then tries SSL2 encryption.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">tlsenabled</option></term>
<listitem><para>Set this property to <replaceable>false</replaceable> to disable
TLS. The default value is <replaceable>true</replaceable> It is good practice
to enable TLS, which is a more secure version of SSL.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">ssl3tlsciphers</option></term>
<listitem><para>A comma-separated list of the SSL3 and/or TLS ciphers to be
used. Use the prefix <command>+</command> to enable or <command>&mdash;</command> to
disable a particular cipher. Allowed values are <replaceable>SSL_RSA_WITH_RC4_128_MD5
</replaceable>, <replaceable>SSL_RSA_WITH_3DES_EDE_CBC_SHA</replaceable>, <replaceable></replaceable>, <replaceable>
SSL_RSA_WITH_DES_CBC_SHA</replaceable>, <replaceable>SSL_RSA_EXPORT_WITH_RC4_40_MD5
</replaceable>, <replaceable>SSL_RSA_WITH_NULL_MD5</replaceable>,<replaceable>SSL_RSA_WITH_RC4_128_SHA
</replaceable>, and <replaceable>SSL_RSA_WITH_NULL_SHA</replaceable>. If no
value is specified, all supported ciphers are assumed to be enabled.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">tlsrollbackenabled</option></term>
<listitem><para>Set to true (default) to enable TLS rollback. TLS rollback
should be enabled for Microsoft Internet Explorer 5.0 and 5.5. This option
is only valid when <option>tlsenabled</option>=<replaceable>true</replaceable>.</para>
</listitem>
</varlistentry>
<varlistentry><term><option role="double-dash">clientauthenabled</option></term>
<listitem><para>Set to true if you want  SSL3 client authentication performed
on every request independent of ACL-based access control. Default value is <replaceable>
false</replaceable>. </para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 role="operands"><title></title>
<variablelist termlength="medium">
<varlistentry><term><replaceable>listener_id </replaceable></term>
<listitem><para> The ID of the HTTP, or IIOP listener for which the SSL element
is to be created. The <replaceable>listener_id</replaceable> is not required
if the <option role="double-dash">type</option> is IIOP-service.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 role="exit-status"><title></title>
<variablelist termlength="medium">
<varlistentry><term>0</term>
<listitem><para> command executed successfully</para>
</listitem>
</varlistentry>
<varlistentry><term>1 </term>
<listitem><para>error in executing the command</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 role="see-also"><title></title>
<para><olink targetdoc="asrefman" targetptr="delete-ssl-1">delete-ssl(1)</olink></para>
</refsect1>
</refentry>
