
Administration Commands                             create-ssl(1)

NAME
     create-ssl - creates and configures the SSL element  in  the
     selected HTTP listener, IIOP listener, or IIOP service

SYNOPSIS
     create-ssl
     [--terse={true|false}][ --echo={true|false} ]
     [ --interactive={true|false} ] [ --host  host]
     [--port port] [--secure| -s ] [ --user  admin_user]
     [--passwordfile filename] [--help]
     [ --target  target]
      --type listener_or_service_type  --certname cert_name
     [--ssl2enabled=false  ] [--ssl2ciphers ss12ciphers ]
     [--ssl3enabled=true ] [--tlsenabled=true ]
     [--ssl3tlsciphers ssl3tlsciphers ] [--tlsrollbackenabled=true ]
     [--lientauthenabled=false  ] [listener_id]

DESCRIPTION
     Creates and configures the SSL element in the  selected  SIP
     listener,  HTTP  listener, IIOP listener, or IIOP service to
     enable secure communication on that listener/service.

     This command is supported in remote mode only.

OPTIONS
     -t --terse                  Indicates that any  output  data
                                 must  be very concise, typically
                                 avoiding   human-friendly   sen-
                                 tences    and   favoring   well-
                                 formatted data  for  consumption
                                 by a script. Default is false.

     -e --echo                   Setting to true  will  echo  the
                                 command  line  statement  on the
                                 standard  output.   Default   is
                                 false.

     -I --interactive            If set to true  (default),  only
                                 the  required  password  options
                                 are prompted.

     -H --host                   The  machine  name   where   the
                                 domain  administration server is
                                 running. The  default  value  is
                                 localhost.

Java EE 5          Last change: 20th Feb 2008                   1

Administration Commands                             create-ssl(1)

     -p --port                   The HTTP/S port for  administra-
                                 tion.  This is the port to which
                                 you should point your browser in
                                 order  to manage the domain. For
                                 example, http://localhost:4848.

                                 The default port number is 4848.

     -s --secure                 If set to true, uses SSL/TLS  to
                                 communicate   with   the  domain
                                 administration server.

     -u --user                   The authorized  domain  adminis-
                                 tration   server  administrative
                                 username.

                                 If you have authenticated  to  a
                                 domain  using  the asadmin login
                                 command,  then  you   need   not
                                 specify  the  --user  option  on
                                 subsequent  operations  to  this
                                 particular domain.

     --passwordfile              The --passwordfile option speci-
                                 fies  the  name,  including  the
                                 full path, of a file  containing
                                 the   password   entries   in  a
                                 specific format. The  entry  for
                                 the   password   must  have  the
                                 AS_ADMIN_ prefix followed by the
                                 password   name   in   uppercase
                                 letters.

                                 For  example,  to  specify   the
                                 domain   administration   server
                                 password, use an entry with  the
                                 following                format:
                                 AS_ADMIN_PASSWORD=password,
                                 where  password  is  the  actual
                                 administrator  password.   Other
                                 passwords  that can be specified
                                 include AS_ADMIN_MAPPEDPASSWORD,
                                 AS_ADMIN_USERPASSWORD,       and
                                 AS_ADMIN_ALIASPASSWORD.

                                 All remote commands must specify
                                 the  admin password to authenti-
                                 cate to the  domain  administra-
                                 tion  server,  either through --

Java EE 5          Last change: 20th Feb 2008                   2

Administration Commands                             create-ssl(1)

                                 passwordfile or  asadmin  login,
                                 or  interactively on the command
                                 prompt. The asadmin  login  com-
                                 mand can be used only to specify
                                 the admin  password.  For  other
                                 passwords,  that  must be speci-
                                 fied for  remote  commands,  use
                                 the --passwordfile or enter them
                                 at the command prompt.

                                 If you have authenticated  to  a
                                 domain  using  the asadmin login
                                 command,  then  you   need   not
                                 specify   the   admin   password
                                 through    the    --passwordfile
                                 option  on subsequent operations
                                 to this particular domain.  How-
                                 ever, this is applicable only to
                                 AS_ADMIN_PASSWORD  option.   You
                                 will  still  need to provide the
                                 other  passwords,  for  example,
                                 AS_ADMIN_USERPASSWORD,   as  and
                                 when required by individual com-
                                 mands, such as update-file-user.

                                 For security reasons,  passwords
                                 specified   as   an  environment
                                 variable will  not  be  read  by
                                 asadmin.

                                 The    default     value     for
                                 AS_ADMIN_MASTERPASSWORD       is
                                 changeit.

     --help                      Displays the help text  for  the
                                 command.

     --target                    Specifies the  target  on  which
                                 you are configuring the SSL ele-
                                 ment. The following  values  are
                                 valid:

                                     o    server-  Specifies  the
                                          default server instance
                                          as the target for  con-
                                          figuring  the  SSL ele-
                                          ment.   server  is  the
                                          name   of  the  default
                                          server instance and  is
                                          the default value.

Java EE 5          Last change: 20th Feb 2008                   3

Administration Commands                             create-ssl(1)

                                     o    config-  Specifies  the
                                          configuration that con-
                                          tains   the   HTTP/IIOP
                                          listener    or    IIOP-
                                          service for  which  SSL
                                          is to be configured.

                                     o    cluster- Specifies  the
                                          cluster  in  which  the
                                          HTTP/IIOP  listener  or
                                          IIOP-service  is  to be
                                          configured   for   SSL.
                                          All      the     server
                                          instances in the  clus-
                                          ter  will  get  the SSL
                                          configuration  for  the
                                          respective  listener or
                                          IIOP-service.

                                     o    instance- Specifies the
                                          instance  in  which the
                                          HTTP/IIOP  listener  or
                                          IIOP-service  is  to be
                                          configured for SSL.

     --type                      The type of service or  listener
                                 for  which  the  SSL is created.
                                 The type can  be  http-listener,
                                 iiop-listener,  or iiop-service.
                                 When the type  is  iiop-service,
                                 the ssl-client-config along with
                                 the  embedded  SSL  element   is
                                 created in domain.xml.

     --certname                  The nickname of the server  cer-
                                 tificate   in   the  certificate
                                 database or the  PKCS#11  token.
                                 The  format  of  the name in the
                                 certificate                   is
                                 tokenname:nickname.   For   this
                                 property,  the   tokenname:   is
                                 optional.

     --ssl2enabled               Set this  property  to  true  to
                                 enable  SSL2.  The default value
                                 is false. If both SSL2 and  SSL3
                                 are   enabled   for   a  virtual
                                 server, the  server  tries  SSL3
                                 encryption  first.  In the event

Java EE 5          Last change: 20th Feb 2008                   4

Administration Commands                             create-ssl(1)

                                 SSL3   encryption   fails,   the
                                 server  then  tries SSL2 encryp-
                                 tion.

     --ssl2ciphers               A comma-separated  list  of  the
                                 SSL2 ciphers to be used. Use the
                                 prefix + to enable or - to  dis-
                                 able    a   particular   cipher.
                                 Allowed   values    are:    rc4,
                                 rc4export, rc2, rc2export, idea,
                                 des, and desede3.  If  no  value
                                 is   specified,   all  supported
                                 ciphers  are   assumed   to   be
                                 enabled.

     --ssl3enabled               Set this property  to  false  to
                                 disable  SSL3. The default value
                                 is true. If both SSL2  and  SSL3
                                 are   enabled   for   a  virtual
                                 server, the  server  tries  SSL3
                                 encryption  first.  In the event
                                 SSL3   encryption   fails,   the
                                 server  then  tries SSL2 encryp-
                                 tion.

     --tlsenabled                Set this property  to  false  to
                                 disable  TLS.  The default value
                                 is true It is good  practice  to
                                 enable  TLS,  which  is  a  more
                                 secure version of SSL.

     --ssl3tlsciphers            A comma-separated  list  of  the
                                 SSL3  and/or  TLS  ciphers to be
                                 used. Use the prefix + to enable
                                 or  -  to  disable  a particular
                                 cipher.   Allowed   values   are
                                 SSL_RSA_WITH_RC4_128_MD5,
                                 SSL_RSA_WITH_3DES_EDE_CBC_SHA, ,
                                 SSL_RSA_WITH_DES_CBC_SHA,
                                 SSL_RSA_EXPORT_WITH_RC4_40_MD5,
                                 SSL_RSA_WITH_NULL_MD5,SSL_RSA_WITH_RC4_128_SHA,
                                 and SSL_RSA_WITH_NULL_SHA. If no
                                 value  is  specified,  all  sup-
                                 ported ciphers are assumed to be
                                 enabled.

Java EE 5          Last change: 20th Feb 2008                   5

Administration Commands                             create-ssl(1)

     --tlsrollbackenabled        Set to true (default) to  enable
                                 TLS   rollback.   TLS   rollback
                                 should be enabled for  Microsoft
                                 Internet  Explorer  5.0 and 5.5.
                                 This option is only  valid  when
                                 -tlsenabled=true.

     --clientauthenabled         Set to true if  you  want   SSL3
                                 client  authentication performed
                                 on every request independent  of
                                 ACL-based     access    control.
                                 Default value is false.

OPERANDS
     listener_id                  The ID of  the  HTTP,  or  IIOP
                                 listener  for which the SSL ele-
                                 ment  is  to  be  created.   The
                                 listener_id  is  not required if
                                 the --type is IIOP-service.

EXIT STATUS
     0                            command executed successfully

     1                           error in executing the command

SEE ALSO
     delete-ssl(1)

Java EE 5          Last change: 20th Feb 2008                   6

