Steps to Fully Setup XTR With HPE SSL
1. Setup HPESSL
When prompted by the SETUP macro, select a listening port and enter it and your XTR port as
the target port.
For details on running the SETUP macro, see "To install a HPE NonStop SSL PROXYS process for
RSC" (beginning on step 3, run setup) of the HPE NonStop SSL Reference Manual.
For details on installing your server certificate, see "Configuring SSL for Production as SSL
Server" in the HPE NonStop SSL Reference Manual.
2. Verify the contents of the generated SCF infile
The default name is SSL-PROXYC-CLIENT
The contents to verfiy specificly are the PORT, TARGETPORT, and CONFIG parameters
PORT is the port any external applications should attempt to connect to for an SSL connection
CONFIG is the name of the config file to be used in the next step
TARGETPORT is the port that should be entered in the TRACL to facilitate the internal XTR connection
ADD PROCESS $ZZKRN.#SSL-PROXYC-CLIENT , &
AUTORESTART 10 , &
CPU FIRSTOF (2) , &
DEFAULTVOL $SYSTEM.ZNSSSL , &
HIGHPIN ON , &
HOMETERM $VHS , &
INFILE $VHS , &
NAME $SDC , &
OUTFILE $VHS , &
PRIORITY 150 , &
PROGRAM $SYSTEM.ZNSSSL.SSLOBJ , &
SAVEABEND OFF , &
STARTMODE APPLICATION , &
STARTUPMSG "PROXYC; SUBNET $ZTC0; PORT <external-port>; &
TARGETSUBNET $ZTC0; TARGETPORT <xtr-port>; &
CONFIG $SYSTEM.ZNSSSL.SSLCONF" , &
STOPMODE STANDARD , &
TYPE OTHER , &
USERID SUPER.SUPER
3. Verify the contents of the generated SSL Configuration file
The CLIENTAUTH and HASHALGORITHMS parameters should be added manually to this file
Check with your IT department that your cacert file is valid if this is a first time setup of HPESSL
IPMODE IPv4
LOGFILE $SYSTEM.ZNSSSL.CLOG
LOGLEVELFILE 50
LOGEMS $0
LOGLEVELEMS 30
LOGCONSOLE *
CLIENTAUTH <ca-cert-file>
HASHALGORITHMS sha256
4. Install XTR
5. Configure the TRCONF
Comment out the SSL SERVER Line
! SSL SERVER 61
6. Configure the TRACL
Use the proxy port (not the XTR port) in the TR_INSTALLATION entry in TRACL
TR_INSTALLATION <xtr-subvol> <ip-address> <xtr-port>