Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CTE-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Widows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

Configuration Parameters

Connection Configuration Parameters

search

Please Note:

printsuggest an edit

Connection Configuration Parameters

ParametersDefaultDescription
Verify_SSL_CertificatenoDirects CADP for Java to verify the IP address or hostname against the Subject Common Name (CN) or the Subject Alternative Name (SAN) in the server certificate presented by the Key Manager during authentication. To use this parameter, SSL must be configured.
Possible settings:
— yes: Enables this feature.
— no: Disables this feature.
SSL_Handshake_Timeoutno defaultAllocates time for the SSL handshake. If SSL handshake doesn't complete within this time period, the connection is closed. SSL must be configured to use this feature.
Possible options:
— 0: If set to 0 or is not set, SSL handshake timeout is not enforced.
— any positive integer.
Use_Persistent_ConnectionsyesEnables the persistent connections functionality.
Possible settings:
— yes: Enables the feature. The client persists the connections.
— no: Disables the feature. A new connection is made for each connection request. The connection is closed as soon as the client receives the server response.
Size_of_Connection_Pool300The total number of client-server connections that your configuration could allow. Set to any positive integer.
Load_Balancing_Algorithmround-robinThe algorithm used to determine how the client selects a Key Manager from a load balancing group.
— round-robin: directs the connection to the next server in the load balancing group.
— random: directs the connection to a randomly selected member of the load balancing group.
Connection_Idle_Timeout600000ms (10 min)Specifies how long a connection can remain idle in the connection pool before the client closes it. Set it to any positive integer.
Unreachable_Server_Retry_Period60000msSpecifies how long a client can attempt to establish a connection to a load-balancing group. After this period, if none of the servers in the load balancing group is reachable, an error is returned. If logging is enabled, error messages are written to the log file.
Possible settings:
— -1: This is the infinite retry interval. The client keeps trying to connect to a server until a connection is established. This setting is not compatible with multi-tier load balancing because the load balancer will never switch tiers.
— 0: If multi-tier load balancing is enabled and Unreachable_Server_Retry_Period is set to 0, the client will not try to connect to a server on the particular load balancer in case all the servers are down in that particular load balancer. The client will move on to the next load balancer, if available, to establish connection.
— A positive integer: If multi-tier load balancing is enabled then set this value between 1 and twice the value of the Connection_Retry_Interval.
Maximum_Server_Retry_PeriodSpecifies how long a client will try to connect to any of the servers on any tier. This parameter should only be set if multi-tiered load balancing is enabled.
Possible settings:
— -1: The connection manager will try every server on every tier until successful.
— 0: Disables the feature; there is no overall limit.
— A positive value: The connection manager will try to make connections for at least the duration set in Maximum_Server_Retry_Period and will return an error if no connection can be made on the tier in use when the try period expires.
Connection_Timeout1mSpecifies how long the client will wait for the connection call to return a value. If a connection cannot be established before the timeout expires, the server is marked as down and is taken out of rotation until the Connection_Retry_Interval has passed.
— 1m: The client will wait 1 minute.
— 0: The client will not force a timeout. The waiting period set by the client’s OS still applies; the client will wait as long as the TCP stack normally waits for a connection.
— Any positive integer: You can use abbreviations (ms, s, m, h, d) to specify the time units (milliseconds, seconds, minutes, hours, days). If you do not include an abbreviation, the default time unit (milliseconds) is used. If your application is time-sensitive, set this parameter a few hundred milliseconds less than your OS’s connection timeout. This will make connections to a down server fail more quickly, in which case failover will occur sooner.
The connection timeout will be set to the lower of the two (Connection_Timeout or OS connection timeout).
Connection_Read_Timeout7000msControls how long the client waits when reading data from a Key Manager before determining that it is down. Requests should only time out if the Key Manager is physically down (e.g. powered off, or not responding because of misconfiguration). The purpose of this parameter is to control how you want the client to react when the Key Manager is down. If you want it to time out eventually and return an error back to your application, then you should set this value to an appropriate number of milliseconds to allow for requests to complete in high load and high latency situations.
Possible setting:
— 0: Disables this setting. The client waits indefinitely until the Key Manager can be reached. Requests remain outstanding until the client’s request is successfully satisfied.
— Any positive integer
Connection_Retry_Interval600000ms (10 minutes)Specifies how long the client waits before trying to reconnect to a disabled server. If one of the Key Managers in a load balanced configuration is not reachable, the client assumes that the server is down, and then waits for the specified time period before trying to connect to it again. If the server or network is under a high load, a connection timeout could occur for a running sever. If your Connection_Retry_Interval is not long enough, another connection attempt will be made to the busy server-adding to its already high load.
Possible setting:
— 0: This is the infinite retry interval. The disabled server will never be brought back into use.
— Any positive integer
Cluster_Synchronization_Delay170sSpecifies how long a client will wait before assuming that key changes have been synchronized throughout a cluster. After creating, cloning, importing, or modifying a key, the client will continue to use the same Key Manager appliance until the end of this delay period. For example, the client sets Cluster_Synchronization_Delay to 170s and sends a key creation request to appliance A, which is part of a cluster. Appliance A creates the key and automatically synchronizes with rest of the cluster. The client will use only appliance A for 170 seconds - enough time for the cluster synchronization to complete. After this time period, the client will use other cluster members as before.
Possible settings:
— 0: disables the function.
— Any positive integer

On this page