x3270 SSL support uses the OpenSSL library. Much of the information below is common to many OpenSSL clients and more extensive documentation is available on the Web.
A secure connection can be negotiated immediately by specifying the L: prefix on the hostname (e.g., L:foo.whatever.net), or can be negotiated later via the TELNET STARTTLS option (which is initiated by the host after the connection has been established).
-----BEGIN CERTIFICATE-----
A certificate is the text between (and including) the BEGIN CERTIFICATE and END CERTIFICATE headers. A private key is the text between (and including) the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY headers. A PEM-format file can contain multiple certificates and keys.
If there are a large number of certificates, the -cadir option (or the caDir resource) can be used to specify a directory containing root certificates. This directory contains files that use the naming convention of hash.seq, where hash is the hash of the certificate value and seq is a sequence number (since multiple certificates could have the same hash) starting with 0.
If your host uses a self-signed certificate, x3270 will not normally allow SSL authentication with it. To allow authentication with self-signed certificates, set the selfSignedOk resource to true.
On Windows, the root certificate database used by wc3270, ws3270 and wpr3287 is installed as part of the setup procedure and updating it is documented below.
The root certificate database is a PEM-format text file called root-certs.txt. The file is located in the wc3270 installation directory (usually C:\Program Files\wc3270, but it can vary with with Windows installations and languages). You can add your root certificate (which must be in PEM format) to this file with a text editor such as Notepad.
The -certfile option (or the certFile resource) defines a file containing the client certificate. By default, this file is in PEM format, but it can also be in ASN1 format, which is specified by setting the -certfiletype option (or the certFileType resource) to the value asn1.
The -chainfile option (or the chainFile resource) defines a PEM-format file containing both the client certificate and any intermediate certificates that were used to sign it. If a chain file is specified, it is used instead of the certificate file.
If no explicit key file is specified, the default is to find the private key in the chain file or the client certificate file (whichever was specified).
If the private key is encrypted, then a password must be specified. The password is given with the -keypasswd option or the keyPasswd resource. The password can have one of two formats. The format file:filename specifies a file containing the password. The format string:string specifies the password as a string in the option or resource directly.
When host certificates are verified, self-signed certificates are not allowed. To allow self-signed host certificates, set the selfSignedOk resource to true or specify the -selfsignedok option.
Also, when host certificates are verified, the name in the host's SSL certificate is checked. This check can be controlled by the acceptHostname resource or the -accepthostname option. The value can be any, which disables hostname checking, DNS:hostname, which matches a specific symbolic hostname, or IP:address, which matches a particular IPv4 or IPv6 numeric address.
wc3270, ws3270 and wpr3287 will not allow secure connections without the OpenSSL DLLs installed on your workstation. These DLLs are not part of the wc3270 installation -- installing them is a completely separate process.
The Windows OpenSSL DLLs for wc3270 are available here:
http://www.slproweb.com/products/Win32OpenSSL.html
The specific files to download are:
https://slproweb.com/download/Win32OpenSSL_Light-1_1_0c.exe (for 32-bit Windows)
https://slproweb.com/download/Win64OpenSSL_Light-1_1_0c.exe (for 64-bit Windows)