IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Specifies
how
to
handle
certificates
from
HTTPS
clients.
Options
are:
never
Never
request
a
client
certificate
required
Always
request
a
client
certificate.
Do
not
accept
the
connection
if
the
client
does
not
present
a
certificate.
When
this
value
is
set
to
required,
all
other
authentication
settings
are
ignored
for
HTTPS
clients.
optional
Always
request
a
client
certificate.
If
presented,
use
it.
prompt_as_needed
Do
not
prompt
for
a
client
certificate
until
the
client
attempts
to
access
a
resource
that
requires
certificate
authentication.
Note:
When
this
value
is
set,
ensure
that
the
ssl-id-sessions
key
in
the
[ssl]
stanza
is
set
to
no.
When
certificate
authentication
is
enabled,
you
must
also
configure
an
appropriate
authentication
library
by
setting
a
key=value
pair
in
the
[authentication-mechanisms]
stanza.
See
“Authentication
libraries”
on
page
419
for
more
information.
This
stanza
entry
is
required.
Default
value:
never
Example
accept-client-certs
=
never
cert-cache-max-entries
=
number_of_entries
Maximum
number
of
concurrent
entries
in
the
Certificate
SSL
ID
cache.
There
is
no
absolute
maximum
size
for
the
cache.
However,
the
size
of
the
cache
cannot
exceed
the
size
of
the
SSL
ID
cache.
A
maximum
size
of
0
allows
an
unlimited
cache
size.
This
stanza
entry
is
required
only
when
the
accept-client-certs
key
is
set
to
prompt_as_needed.
The
default
value
is
1024.
Example:
cert-cache-max-entries
=
1024.
See
also
“Enable
and
configure
the
Certificate
SSL
ID
cache”
on
page
153.
cert-cache-timeout
=
number_of_seconds
Maximum
lifetime,
in
seconds,
for
an
entry
in
the
Certificate
SSL
ID
cache.
The
minimum
value
is
zero.
A
value
of
zero
mean
that
when
the
cache
is
full,
the
entries
are
cleared
based
on
a
Least
Recently
Used
algorithm.
This
stanza
entry
is
required
only
when
the
accept-client-certs
key
is
set
to
prompt_as_needed.
The
default
value
is
120.
Example:
cert-cache-timeout
=
120
See
also
“Set
the
timeout
for
Certificate
SSL
ID
cache”
on
page
154.
[http-headers]
stanza
http-headers-auth
=
{none|http|https|both}
416
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide