(r19) APPXClientEncryption < Main

Tags: view all tags
---+ APPX Desktop Client Encryption 
_Effective with Release 5.0.0, the APPX Desktop Client includes an option to enable SSL encryption for "Remote" APPX Desktop Client sessions._ 

%TOC% 
---++ Overview 

Release 5.0.0 or higher&nbsp;of the APPX Desktop Client allows SSL encryption to optionally be&nbsp;enabled for "Remote" APPX Desktop Client sessions&nbsp;when connecting to&nbsp;APPX Server 5.0.0 or higher.&nbsp;&nbsp;The&nbsp;APPX Desktop Client SSL encryption feature encrypts all data transmitted between the APPX Desktop Client and the APPX Server including login ID, password, all session data, all reports printed by the client, and all files transferred between the client and the server.&nbsp; The APPX Desktop Client can only establish an encrypted SSL connection&nbsp;with an APPX Server that has an [[APPXLoginManager][APPX Login Manager]] that supports and that has been properly&nbsp;configured to accept SSL connection requests from the various types of APPX clients.&nbsp; The APPX Login Manager on the APPX Server may be configured to either require that an APPX Desktop Client that is requesting a connection&nbsp;must use SSL encryption,&nbsp;to only use SSL encryption if so requested by the APPX Desktop Client that is requesting a connection, or&nbsp;to only accept "clear text" connections from an APPX Desktop Client that is requesting a connection.&nbsp; If an SSL session is initiated, the APPX Login Manager may further require that the APPX Desktop Client identify itself by providing an acceptable SSL certificate [<font color="#0000ff">Note: This feature is not yet implemented by the APPX Desktop Client</font>]. 
---++ APPX Desktop Client Handshake 

When&nbsp;an APPX Desktop Client&nbsp;connects with an APPX Login Manager to establish a client session with an APPX Server, the first step is to complete a "handshake".&nbsp; The handshake exchanges version and configuration information between the APPX Desktop Client and the APPX Login Manager.&nbsp;&nbsp;This information is used to determine whether the connection should use enable SSL encryption&nbsp;or&nbsp;use "clear text". 

APPX Desktop Client versions prior to 5.0&nbsp;are not able to connect using SSL.&nbsp; If you want to use SSL, you must upgrade your&nbsp;APPX Desktop Client&nbsp;to version 5.0 or higher.&nbsp; You must also upgrade your server to APPX Server version 5.0 or higher.&nbsp; The following chart shows the types of connections that are technically possible for the various combinations of versions of the APPX Desktop Client and APPX Server.&nbsp; Please note that while it is technically possible for an APPX Desktop&nbsp;Client version prior to 5.0 to connect to an APPX Server version&nbsp;of 5.0 or higher, this combination is not recommended or supported since upward compatibility of old APPX Desktop Client versions with newer APPX Server versions is not assured.&nbsp;&nbsp;The APPX Desktop Client version should always be the same or higher than the APPX Server version with which a session is to be established. 

| *Client/APPX Versions* | *APPX-Prior to 5.0&nbsp;* | *APPX-5.0 &amp; Higher* |
| Client - Prior to 5.0 | Clear Text Only | Clear Text Only |
| Client - 5.0&nbsp;&amp; Higher | Clear Text Only | Clear Text or SSL |

---++ APPX Desktop Client Preferences - SSL&nbsp; 

The APPX Desktop Client&nbsp;provides five preferences (parameters)&nbsp;relating to&nbsp;configuring&nbsp;the APPX Desktop Client&nbsp; to use SSL&nbsp;encryption. 

&nbsp; 
   * APPX Desktop Client Preferences - SSL: <br />

<img width="818" alt="SSLPreferences.PNG" src="%ATTACHURL%/SSLPreferences.PNG" height="149"> 
---+++ [[#SSLMode][SSLMode]] 

The SSLMode preference&nbsp;is used to identify the type of connection that the APPX Desktop Client should attempt to establis - either SSL or "clear text".&nbsp; Depending on the value specified for [[APPXClientEncryption#SSLMode?skin=kupu;wysiwyg_edit=1;t=080919192949][SSLMode]],&nbsp;the other SSL preferences may not always be relevant. 

&nbsp; 
   1 *Required* - This option is used to "Require" that the APPX Desktop Client establish an SSL connection with the APPX Login Manager on the APPX Server.&nbsp;&nbsp;In the event that the APPX Login Manager is an older version that does not support SSL connections or if the APPX Login Manager is not configured to allow SSL connections, the client will display an error dialog informing the user that an SSL connection with the requested APPX server is not available.&nbsp;&nbsp;The value of [[#SSLMismatchAllowed][SSLMismatchAllowed]] will determine if the user is provided with an option to continue with a "clear text" connection.
   1 *Optional* - This option is similar to the *Required* option.&nbsp; However, in the event that the APPX Server does not support or is not configured to support an SSL connection, the client will automatically&nbsp;establish a "clear text" connection&nbsp;without notifying the user.&nbsp; The [[#SSLMismatchAllowed][SSLMismatchAllowed]] preference is not relevant when this option is specified.
   1 *Disabled* - This option is used to "Disable" the APPX Desktop Client's ability to establish an SSL connection.&nbsp; In other words, this option is used to "require" that&nbsp;the APPX Desktop Client establish a "clear text" connection&nbsp;with the APPX Login Manager on the APPX Server.&nbsp;&nbsp;In the event that the APPX Login Manager is not configured to allow a "clear text" connection, the client will display an error dialog informing the user that a "clear text" connection with the requested APPX Server is not allowed.&nbsp; The value of [[#SSLMismatchAllowed][SSLMismatchAllowed]] will determine if the user if provided with an option to continue with an SSL connection.&nbsp;
   1 *Pre43* - This option is used to specify that&nbsp;the Pre-5.0 Handshake protocol is to be used to&nbsp;initiate a "clear text" APPX Desktop Client connection with an APPX Server.&nbsp; If a "clear text" connection cannot be established within 5 seconds, the connection attempt will fail.&nbsp;&nbsp;This option is compatible with all versions of the APPX Login Manager including older versions such&nbsp;as appxdsvc.exe, winappxd, and appxd that did not have SSL capabilities.&nbsp; Since this option can only establish a "clear text" connection, the other SSL perferences are not relevant when this option is specified.
---+++ <nop>SSLAnonAllowed 

This preference determines whether or not the APPX Desktop Client is allowed to connect to an APPX Server that does not have an SSL certificate signed by a trusted authority such as Verisign or Thawte. 
   1 *True* - An SSL connection is allowed whether or not the server has a signed certificate.&nbsp;
   1 *False* - An SSL connection is only allowed if the server has a signed certificate.
---+++ [[#SSLMismatchAllowed][SSLMismatchAllowed]] 

This preference determines whether or not the user is provided with an option to continue in the event that the required connection type is not available.&nbsp; If set to False, the user will be presented with an Error Dialog Window in the event that the requested type of connection cannot be established.False, the user is given the option of continuing with a different type of connection or cancelling.&nbsp; For example, if&nbsp; [[#SSLMode][SSLMode]] is set to Required but the server does not allow 
   1 *True* - If the requested type of connection, either SSL or "clear text",&nbsp;is not available, the user is provided an option to continue with the type of connection that is available.
   1 *False* - If the requested type of connection, either SSL or "clear text", is not available, the connection attempt fails.
---+++ <nop>SSLSelfSignedAllowed 

This preference determines whether or not the APPX Desktop Client is allowed to establish an SSL connection with&nbsp;an APPX Server that has a self-signed SSL certificate. 
   1 *True* - The connection is allowed
   1 *False* - The connection is not allowed
---+++ <nop>SSLHandshakeTimeout 

This preference specifies the length of time in seconds that the client is to wait after attempting to establish an SSL connection with the APPX Login Manager.&nbsp; If the specified amount of time passes without establishing an SSL connection, then the connect request will fail.&nbsp; This option is not relevant when the value of [[#SSLMode][SSLMode]] is "Pre43". 
   1 An integer 0 through 10, with the default being 3.

---++ APPX&nbsp;Login Manager Prameters - SSL 

Please refer&nbsp;to the&nbsp; [[APPXLoginManager][APPX Login Manager]] for information relating to SSL server configuration options. 

---++ Known Limitations 
   1 The APPX Desktop Client has not yet implemented the feature that will allow a certificate on the client to be provided to the APPX Server.
---++ Comments: 
_Read what other users have said about this page or add your own comments._ 
---

SSLMode - The option value should be changed from&nbsp;Pre43 to be&nbsp;<nop>NoSSL or <nop>PreSSL 

-- SteveFrizzell - 19 Sep 2008 %COMMENT% 

-- AlKalter - 04 Apr 2008 

</img>