IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Thus,
the
default
value
for
cert-cache-max-entries
is
1024,
which
is
one
quarter
of
the
default
value
for
ssl-max-entries,
which
is
4096.
Note:
Most
client
requests
to
WebSEAL
occur
over
SSL
connections,
and
all
requests
over
SSL
connections
without
certificates
must
check
the
cache.
Thus,
keeping
the
cache
size
smaller
can
significantly
improve
performance.
Set
the
timeout
for
Certificate
SSL
ID
cache
This
configuration
step
applies
only
when
delayed
certificate
authentication
has
been
enabled.
Complete
the
following
steps:
1.
Verify
that
certificate
authentication
is
enabled.
See
“Enable
certificate
authentication”
on
page
151
2.
Edit
the
WebSEAL
configuration
file.
In
the
[certificate]
stanza,
adjust
the
value
of
cert-cache-timeout
as
necessary.
[certificate]
cert-cache-timeout
=
120
The
value
is
the
maximum
lifetime
for
an
entry
in
the
cache,
expressed
as
a
number
of
seconds.
Use
the
default
value
unless
your
conditions
warrant
modifying
it.
Possible
reasons
to
modify
the
value:
v
Systems
with
memory
restrictions
may
want
to
reduce
the
expiration
time.
v
The
expiration
time
might
need
to
be
increased
if
there
is
a
significant
lag
between
the
time
when
the
user
initiates
a
certificate
transfer
and
when
the
user
actually
submits
the
certificate.
v
Lower
values
clean
out
the
cache
sooner
when
no
certificate
authentications
are
required.
This
frees
system
memory.
Specify
an
error
page
for
incorrect
protocol
This
configuration
step
applies
only
when
delayed
certificate
authentication
has
been
enabled.
WebSEAL
provides
a
default
HTML
page
containing
an
error
message
to
be
displayed
when
an
authenticated
user
attempts
to
increase
the
authentication
strength
level
to
client
authentication
from
an
HTTP
session.
Users
attempting
to
increase
authentication
level
to
certificate
authentication
must
use
the
HTTPS
protocol.
Administrators
can
choose
to
either
use
the
default
error
page,
customize
the
error
message,
or
specify
an
entirely
different
customized
error
page.
Typically,
administrators
use
the
default
page
but
might
customize
the
contents
of
the
error
message.
Administrators
who
choose
to
create
a
new
HTML
error
page
must
edit
the
WebSEAL
configuration
file
to
indicate
the
location
of
the
new
page.
The
default
WebSEAL
configuration
file
entry
is:
[acnt-mgt]
cert-stepup-http
=
certstepuphttp.html
154
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide