x3270 SSL support uses the OpenSSL library. Much of the information below is common to many OpenSSL clients and more extensive documentation is available on the Web.
A secure connection can be negotiated immediately by specifying the L: prefix on the hostname (e.g., L:foo.whatever.net), or can be negotiated later via the TELNET STARTTLS option (which is initiated by the host after the connection has been established).
-----BEGIN CERTIFICATE-----
A certificate is the text between (and including) the BEGIN CERTIFICATE and END CERTIFICATE headers. A private key is the text between (and including) the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY headers. A PEM-format file can contain multiple certificates and keys.
If there are a large number of certificates, the -cadir option (or the caDir resource) can be used to specify a directory containing root certificates. This directory contains files that use the naming convention of hash.seq, where hash is the hash of the certificate value and seq is a sequence number (since multiple certificates could have the same hash) starting with 0.
If your host uses a self-signed certificate, x3270 will not normally allow SSL authentication with it. To allow authentication with self-signed certificates, set the selfSignedOk resource to true.
On Windows, the root certificate database used by wc3270, ws3270 and wpr3287 is installed as part of the setup procedure and updating it is documented below.
The root certificate database is a PEM-format text file called root-certs.txt. The file is located in the wc3270 Application Data directory. (The Application Data directory varies between Windows releases, but it is easily found by selecting wc3270 Explore AppData in the wc3270 program group.) You can add your root certificate (which must be in PEM format) to this file with a text editor such as Notepad.
The -certfile option (or the certFile resource) defines a file containing the client certificate. By default, this file is in PEM format, but it can also be in ASN1 format, which is specified by setting the -certfiletype option (or the certFileType resource) to the value asn1.
The -chainfile option (or the chainFile resource) defines a PEM-format file containing both the client certificate and any intermediate certificates that were used to sign it. If a chain file is specified, it is used instead of the certificate file.
If no explicit key file is specified, the default is to find the private key in the chain file or the client certificate file (whichever was specified).
If the private key is encrypted, then a password must be specified. The password is given with the -keypasswd option or the keyPasswd resource. The password can have one of two formats. The format file:filename specifies a file containing the password. The format string:string specifies the password as a string in the option or resource directly.
The secure versions of wc3270, ws3270 and wpr3287 will not function without OpenSSL DLLs installed on your workstation. These DLLs are not part of the wc3270 installation -- installing them is a completely separate process.
The Windows OpenSSL DLLs for wc3270 are available here:
http://www.slproweb.com/products/Win32OpenSSL.html
The specific file to download is:
http://www.slproweb.com/download/Win32OpenSSL_Light-1_0_0d.exe