1. Mainframe Adapter for TCP CICS User’s Guide
  2. Configuring Oracle TMA TCP Security
  3. Security Enforcement: SSL/TLS Support
  4. Securing Inbound Services to Add TLS Support

3.3.2 Securing Inbound Services to Add TLS Support

The TMA TCP for CICS Inbound flow uses Sockets for CICS Listener. Follow these steps to enable TLS Support.
  1. Configure and enable mutual TLS on the client side – SSL.
  2. Enable the GETTID (Get AT-TLS ID) parameter to get client certificates and user IDs from AT-TLS by setting it to YES in the IBM listener configuration via EZAC transaction.

    If the status is ENABLED, the listener can get client certificates and user IDs through AT-TLS enabled in the TCP/IP stack.

  3. Ensure to check both client and server certificates for two-way authentication:
    1. CICS keyring must have client and server certificates.
    2. Tuxedo wallet must have client and server certificates.
  4. Define and load AT-TLS inbound rule (CICS_SERVER) in policy agent for configured port on IBM Listener, follow the listing.

    TTLSEnvironmentAction must specify HandshakeRole as ServerWithClientAuth with ApplicationControlled off.

    Listing Sample reference for TTLSEnvironmentAction, HandshakeRole, ApplicationControlled
    TTLS Condition Summary:                 NegativeIndicator: Off
   Local Address:
    FromAddr:           All
    ToAddr:             All
   Remote Address:
    FromAddr:           All
    ToAddr:             All
   LocalPortFrom:       3010              LocalPortTo:       3010
   RemotePortFrom:      0                 RemotePortTo:      0
   JobName:                               UserId:
   ServiceDirection:    Inbound

HandshakeRole:              ServerWithClientAuth
    SuiteBProfile:              Off
    TTLSKeyringParms:
     Keyring:                   SYSCICS/CICSRING
    TTLSEnvironmentAdvancedParms:
     SSLv2:                     Off
     SSLv3:                     Off
     TLSv1:                     Off
     TLSv1.1:                   Off
     TLSv1.2:                   On
     TLSv1.3:                   Off
     MiddleBoxCompatMode:       Off
     ApplicationControlled:     Off

Figure 3-3 Sample Inbound AT-TLS rule - from IBM’s IP CICS Sockets Guide


Sample Inbound AT-TLS rule - from IBM’s IP CICS Sockets Guide Diagram

Parent topic: Security Enforcement: SSL/TLS Support