150 IBM Content Manager OnDemand Guide
Authentication and verification allow both the client and server to verify that they are 
communicating with the intended receiver. Data encryption prevents the packets of 
information that are traveling through the network to be viewed by anyone who can access 
the network. 
During an SSL handshake, a client and server securely exchange digital signatures and 
encryption keys by using a public-key algorithm (usually Rivest-Shamir-Adleman algorithm 
(RSA)). The client and server establish a secure connection with this identity and key 
information. After the client and server establish a secure session, they transmit the data to 
each other, encrypting it with a symmetric algorithm, such as AES.
Trusted parties, which are called certificate authorities (CAs), issue digital certificates to verify 
the identity of an entity, such as a client or a server. The digital certificate serves the following 
purposes:
/SM590000Verifies the identity of the owner
/SM590000Makes the public key of the owner available
The IBM Global Security Kit (GSKit) provides libraries for data encryption and SSL 
communication.
The GSKit package also installs the iKeyman key management utility (gsk7ikm), which you 
can use to create key databases, public-private key pairs, and certificate requests. For 
information about the iKeyman utility and the GSKCmd command-line interface, see the IBM 
Developer Kit and Runtime Environment, iKeyman 8.0 User’s Guide at the following website:
http://download.boulder.ibm.com/ibmdl/pub/software/dw/jdk/security/60/iKeyman.8.Us
er.Guide.pdf
After a Content Manager OnDemand client (for example, the Content Manager OnDemand 
Windows client, ARSDOC, or OnDemand Web Enablement Kit (ODWEK) Java API) is 
configured to log on to a Content Manager OnDemand library server with SSL, all 
communication to and from that client is performed by using SSL:
/SM590000Between the client and the library server 
/SM590000Between the client and the object servers
To use SSL, it must be enabled on both the server and the client components of Content 
Manager OnDemand.
Important considerations exist when you use SSL. We describe them in the following 
subsections.
Note: Implementation of SSL is optional. The Content Manager OnDemand server can be 
configured to listen on either a non-SSL port or an SSL port, or it can listen on both types 
of ports. To implement SSL, click New server. In the Add a Server window that opens, 
select Use Secure Sockets Layer. If your server does not support SSL, SSL is not used 
even if you select this check box.