How to set up an OutsideView SSL over Telnet Session
If XHE is available:
Create a cert on the NonStop using XHE.
a. Volume to the XYGATEHE installation
b. Edit the SSLHECFG file
c. Change the common_name to the DNS name for the NonStop node to where the session will connect.
Example:
common_name=galaxy.xypro.com
d. Set the days parameter to the number of days before the certificate should expire.
Example:
days=365
e. Exit the file and run MAKECRT. From a TACL:
RUN MAKECRT CA
2. Two certificate files, SSLCACRT and SSLHECRT will be created in the XYGATEHE subvolume. Both will need
to be downloaded, in binary format to a termporary location on the Windows machine that will be used to
connect to the NonStop. From there, they will need to be imported into the Windows certificate store. Both will
need to be installed in both the Trusted Root Certification Authorities store and Intermediate Certification
Authorities store. Download SSLCACRT as sslca.crt and SSLHECRT as sslhe.crt.
3. Import the certificates into the Windows certificate store. On the Windows PC:
a. Windows 10 and Windows 11:
In the search field in the taskbar at the bottom of the Windows display, enter "Certificates". From the options
that appear, chose "Manage Computer Certificates".
b. The Certificates store shoud appear. Right click on "Trusted Root Certification Authorities" in the rightmost
Logical Store Name column. Select "All Tasks", then "Import"
c. Click Next to continue
d. Enter the temporary location where the downloaded certificates were stored. Select sslca.crt. The .crt
extension will not be displayed, but the file should still show as Type Security Certificate.
e. Click the Open button
f. Click Next
3. Start an SSL-enabled listener on the port to be used to connect to the host system
To start a temporary XHE listener:
7735 $system.xygatehe.xygatehe -a:TELNET -p:23 -ssl_neg:sslsrv
The example above assumes that XYGATEHE is installed at $SYSTEM.XYGATEHE and uses port 7735
NOTE: The above example is only a temporary listener. The listener process will be stopped when the
system is shut down. To add a permanent listener on the port, an entry must be made to the
$SYSTEM.ZTCPIP.PORTCONF or $SYSTEM.ZTCPIP.XYCONF files..
4. Click on the New Session icon in the upper left corner of the OutsideView toolbar:
5. Make sure that the Emulation field set set to Tandem, the I/O field is set to TCP IP/SSL and the Protocol field is
set to Telnet:
6. Select IO in the left column. Check the following boxes:
Encrypt datastream using SSL.
Invoke Service / Logon Script box. Enter a valid Telnet service name in the field below this box.
Validate certificate against browser certificate store
Validate certificate CN against domain name
7. Click OK to save
If XHE is not available on the NonStop:
1. If it is installed and configured HPE SSL will need to be used on the NonStop host instead of XHE. The
way to confirm whether it is installed is to check for the secure telnet proxy server. From a TACL:
SCF INFO PROCESS $ZZKRN.#SSL-TELNET*
Sample Output:
NONSTOP KERNEL - Info PROCESS \GALAXY.$ZZKRN
Symbolic Name *Name *Autorestart *Program
SSL-TELNET-992 $T992 10 $SYSTEM.ZNSSSL.SSLOBJ
SSL-TELNETS-1 $TLNS1 10 $SYSTEM.ZNSSSL.SSLOBJ
SSL-TELNETS-TLNS $TLNS 10 $SYSTEM.ZNSSSL.SSLOBJ
SSL-TELNETS-V6 $TLNV6 10 $SYSTEM.ZNSSSL.SSLOBJ
"SSL-TELNET" is the naming convention used by the HPE SSL Setup macro when installing the telnet proxy. If no telnet proxys were installed, then no symbolic names would have been displayed.
2. Determine the port number used by the given proxy:
SCF INFO PROCESS $ZZKRN.#<symbolic name>, DETAIL
Where <symbolic name> is the name of the SSL telnet proxy, e.g. SSL-TELNETS-1
SEE:
NONSTOP KERNEL - Detailed Info PROCESS \GALAXY.$ZZKRN.#SSL-TELNETS-1
*AutoRestart...............10
*BackupCPU.................Not Specified
*CPU.......................01
*DefaultVolume.............$SYSTEM.ZNSSSL
*ExtSwap...................Not Specified
*Highpin...................ON
*HomeTerminal..............$ZHOME
*InFile....................$ZHOME
*Library...................Not Specified
*MemPages..................Not Specified
*Name......................$TLNS1
*OutFile...................$ZHOME
*PFSSize...................Not Specified
*PrimaryCPU................Not Specified
*Priority..................150
*Program...................$SYSTEM.ZNSSSL.SSLOBJ
*SaveAbend.................OFF
*StartMode.................SYSTEM
*StartupMessage............TELNETS; SUBNET $ZTC0; PORT 8423; TARGETSU
BNET $ZTC0; TARGETPORT 23; CONFIG $SYSTEM
.ZNSSSL.TLNSCF1
*StopMode..................STANDARD
*Type..........................OTHER
*UserId......................SUPER.SUPER ( 255,255 )
In the above example, the port used for SSL over telnet is 8423.
Once the port number for HPE SSL over telnet is known, the terminal emulation session can be configured in OutsideView.
3. Start OutsideView. Click on the New Session icon in the upper left corner of the OutsideView toolbar:
4. Make sure that the Emulation field set set to Tandem, the I/O field is set to TCP IP/SSL and the Protocol field is
set to Telnet:
5. Select IO in the left column. Check the following boxes:
Encrypt datastream using SSL.
Invoke Service / Logon Script box. Enter a valid Telnet service name in the field below this box.
Validate certificate against browser certificate store
Validate certificate CN against domain name
You may also need to select "Allow user override of errors to permit connection". if the initial connection attempt
fails.
7. Click OK to save