Certificate-based authentication over an SSL connection is the
most secure type of authentication. Therefore, when
authentication occurs at the connection layer, the client does
not need to provide an additional name (bind DN) and password to
Directory Proxy Server during the LDAP bind. A client can only
perform certificate-based authentication over an SSL connection.
The basic steps in establishing an SSL connection are as
follows: The client requests that a secure connection be
established. As part of this request, Directory Proxy Server
provides a server certificate to the client. A server
certificate is a single certificate associated with one instance
of Directory Proxy Server. When a secure connection is used, the
server certificate identifies the instance of Directory Proxy
Server to the client. The establishment of the connection
includes a negotiation phase. During this phase, the client and
Directory Proxy Server attempt to agree on the encryption policy
that is used. The server certificate contains