Go to main content

man pages section 1M: System Administration Commands

Exit Print View

Updated: July 2017



ksslcfg - enable and configure SMF instance of Kernel SSL


ksslcfg create -f pkcs11 -T <token_label> [-d softtoken_directory] -C 
  <certificate_label> [-h <ca_certchain_file>] 
             -p <password_file> [options] -x <proxy_port> [<server_address>] 
ksslcfg create -f pkcs12 -i <cert_and_key_pk12file> 
             -p <password_file> [options] -x <proxy_port> [<server_address>] 
ksslcfg create -f pem -i <cert_and_key_pemfile> 
             -p <password_file> [options] -x <proxy_port> [<server_address>] 
ksslcfg delete [-v] [
host] ssl_port
ksslcfg -V
ksslcfg -?


ksslcfg manages smf(5) instances for the Kernel SSL proxy module. An SSL-enabled web server can use the services of its Kernel SSL proxy to improve the performance of the HTTPS packets processing. It does so by creating an instance of the Kernel SSL service, specifying the SSL proxy port and parameters, and by listening on the proxy port.

The create subcommand creates an instance and enables the service for the given address and SSL port.

The delete subcommand disables the service for the given address and port, if it is enabled, and deletes the instance from the SMF repository.

ksslcfg can be run as root or by other users assigned to the Network Security profile. See rbac(5) and user_attr(4).

After ksslcfg successfully configures the service in the kernel, the proxy application must be started, or restarted if it is already running.

You must run ksslcfg to configure your Kernel SSL proxy before you start your application.

ksslcfg allows you to specify an ssl_port operand, described under OPERANDS, and, with the –x option, a proxy_port value. When specified for use with the Kernel SSL proxy, these values cannot also be configured for the Solaris Network Cache and Acceleration (NCA) feature.

The Fault Managed Resource Identifier (FMRI) for the kernel SSL proxy instances is svc://network/ssl/proxy. ksslcfg creates an instance of that service unique to the combination of host and SSL port. Instance FMRIs for particular proxy entries can be found with svcs(1) and used for dependencies of other services. The state of the service instance tracks in-kernel configuration only. It does not reflect the presence or state of the application listening on the proxy port.


The following options are supported:

–c ciphersuites

Set of ciphers a client is allowed to negotiate in a sorted order. The supported SSLv3 and TLSv1.0 ciphers are listed below. Note that the names are separated by comma and are case-insensitive.

–s versions

Set of versions of SSL/TLS protocol which are administratively enabled for Kernel SSL proxy module. Recognized values are SSLv3 and TLSv1.0. By default only TLSv1.0 is enabled. Note that the versions are separated by comma and are case-insensitive.

–f key_format

Uses the certificate/key format specified in key_format . The supported options are pkcs11, pkcs12 , and pem.

–i key_and_certificate_file

When pkcs12 or pem is specified with the –f option, reads a key and a certificate of the web server from key_and_certificate_file. This file can also contain any intermediate CA certificates that form the certificate chain to the root CA for the server certificate. These certificates must follow the server certificate in the file and the order must be bottom up: lowest level CA certificate followed by the next higher level CA certificate, and so on.

–C certificate_label

PKCS#11 can store multiple certificates in single token. This option enables you to specify a single certificate, identified by certificate_label . This label must match the CKA_LABEL on the certificate object in the token specified by –T. This option is to be used only with –f pkcs11.

–d softtoken_directory

This option is applicable only with the pkcs11 key format, when the token label is the Sun Software PKCS#11 softtoken. Use this option to override the default location of the PKCS#11 softtoken directory ($HOME/.sunw). See pkcs11_softtoken(5).

–h ca_certchain_file

When pkcs11 is specified with the –f option, reads a set of intermediate CA certificates that form the certificate chain to the root CA for the server certificate (specified with the –C option), from ca_certchain_file. The file must be in PEM format.

–p password_file

Obtains the password used to encrypt the private key from password_file. When using the pkcs11 option (see –f, above), the password is used to authenticate the user to the PKCS #11 token.

–k ssl_handshake_timeout

The timeout value in seconds for SSL handshake to finish. If the handshake does not finish until the timeout specified the connection will be torn down. The default value is 30 seconds.

–n ssl_handshake_limit

Maximum number of simultaneous SSL handshakes. Once the number of handshakes reaches this number, all new handshakes will get refused. The default value is 65536.

–t ssl_session_cache_timeout

The timeout value, in seconds, for an SSL session. It corresponds to SSL3SessionTimeout of the Sun ONE web server configuration or SSLSessionCacheTimeout of mod_ssl.

–T token_label

When pkcs11 is specified with –f, uses the PKCS#11 token specified in token_label. Use cryptoadm list –v to display all PKCS#11 tokens available.

–u username

The username of the user who owns the password file. If omitted, the system will try to read the password file as root.


Verbose mode.


Displays the version.

–x proxy_port

The SSL proxy port. The port number is designated exclusively for clear-text HTTP communication between the web server and the kernel SSL proxy module. No external HTTP packets are delivered to this port.

–z ssl_session_cache_size

The maximum number of SSL sessions that can be cached. It corresponds to SSLCacheEntries of the Sun ONE web server configuration. When this option is not specified, the default is 5000 entries.


Displays the usage of the command.


[host] [ssl_port ]

The address and the port of the web server for which the kernel SSL entry is created. If host is omitted, the entry will be used for all requests that arrived at the ssl_port, regardless of the destination address. Both a host name and an IP address are acceptable forms for host. ssl_port is required. Typically, this has a value of 443.


Example 1 Create and Enable a Kernel SSL Instance

The following command creates and enables a Kernel SSL instance using a certificate and a key in PKCS#11 format.

# ksslcfg create -f pkcs11 -T "Sun Software PKCS#11 softtoken"  \
-C "Server-Cert" -p /some/directory/password -u webservd \
-x 8080 www.mysite.com 443

% svcs svc:/network/ssl/proxy
STATE          STIME    FMRI
online         Sep_27   svc:/network/ssl/proxy:kssl-www-mysite-com-443
Example 2 Create and Enable a Default Instance for All Addresses

The following command creates and enables a default instance for all addresses from a certificate and key in a pkcs#12 file.

# ksslcfg create -x 8888 -f pkcs12 -i /some/directory/keypair.p12 \
    -p /some/directory/password -u webservd 443
Example 3 Create and Enable an Instance with Specific Cipher Suites

The following command creates and enables an instance with specific cipher suites.

# ksslcfg create -x 8080 -f pem \
-i /some/directory/keypair.pem -p /some/directory/password \
-c "rsa_rc4_128_md5,rsa_rc4_128_sha" \ 443
Example 4 Disable and Delete an Instance

The following command disables and deletes an instance.

# ksslcfg delete www.mysite.com 443
Example 5 Establishing Dependency of Proxy Application

The sequence of commands shown below establishes a dependency of a proxy application on a KSSL instance. Note that he proxy application should only be started after the SSL kernel proxy instance has been started.

The following commands establish the dependency of an Apache 2.2 web server. KSSL has been configured to listen on SSL port 443 and a wildcard address.

# svccfg -s svc:/network/http:apache22
svc:/network/http:apache22> addpg kssl dependency
svc:/network/http:apache22> setprop kssl/entities = fmri:svc:/network/\

svc:/network/http:apache22> setprop kssl/grouping = astring: require_all

svc:/network/http:apache22> setprop kssl/restart_on = astring: refresh

svc:/network/http:apache22> setprop kssl/type = astring: service
svc:/network/http:apache22> end

Following these commands, enable the web server:

# svcadm enable svc:/network/http:apache22

If the web server was already running, restart it:

# svcadm refresh svc:/network/http:apache22
# svcadm restart svc:/network/http:apache22

Exit Status


Successful completion.


An error occurred.


See attributes(5) for descriptions of the following attributes:

Interface Stability
See below.

Command line options and the utility name are Committed. The command output, the FMRI service name (svc://network/ssl/proxy), and the FMRI instance's name format are Uncommitted

See Also

svcprop(1), svcs(1), cryptoadm(1M), svcadm(1M), svccfg(1M), user_attr(4), attributes(5), kssl(5), pkcs11_softtoken(5), rbac(5), smf(5), nca(7d)

Chown, P., Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS), RFC 3268, June 2002.


ksslcfg create without an host argument creates an INADDR_ANY smf instance. ksslcfg delete without an host argument deletes only the INADDR_ANY instance. ksslcfg delete needs a host argument to delete any non-INADDR_ANY instance.

On a system with zones(5) installed, the ksslcfg command can be used only in the global zone at this time.