Using a server-side certificate, a client communicating with the Relay Server can verify the web server that is running the Relay Server is a trusted server. The client verifies the web server's public certificate with the root certificate stored on the client. If the certificates are verified, a key exchange occurs to establish the encrypted connection.

Using a client-side certificate, the web server can verify that a client communicating with the Relay Server is a trusted client. The web server verifies the client's public certificate with its root certificate that is stored in the certificate manager on the web server machine. If the certificates are verified, a key exchange occurs to establish the encrypted connection.

The rs.config file is used by the Relay Server to define the peer list of Relay Servers, if running in a farm environment, including the backend farm and backend server configurations. Each Relay Server in the environments needs to maintain a copy of the rs.config file.

The configuration of the backend farm and backend servers ensures the Relay Server only communicates with machines with which it has been configured. Any attempted communication with machines for which the Relay Server has not been configured will be refused.

The backend farm can be configured to specify the level of communication security when accepting requests from the clients and the RSOE. There is a client_security and backend_security option that allows the backend farm to specify the type of communication that can be established. This option is specified as follows:

For more information, see:

• Relay Server configuration file

The RSOE establishes the connection between the backend server and the Relay Server using three phases: 1) startup phase, 2) ready phase 3) working phase. For a detailed description of the RSOE startup, see:

• Windows IIS  http://www.sybase.com/detail?id=1059277
• Apache  http://www.sybase.com/detail?id=1065869

In the backend server section of the rs.config file, each server that exists in the backend farm is configured with an ID and associated farm name. The ID corresponds to the server name. The Relay Server has the ability to verify the MAC address of the machine running the RSOE to ensure the server communicating from within the internal firewall is trusted and allowed to establish a connection with the Relay Server. The MAC property is the MAC address of the network adapter used by the RSOE. The address is specified in IEEE 802 MAC-48 format.

The backend server section also allows for the configuration of a security token that is used by the Relay Server to authenticate the backend server connection. The token must be provided upon startup of the RSOE when establishing the connection with the Relay Server.

The MobiLink client uses HTTP or HTTPS to communicate with the Relay Server. With HTTPS communication, data is temporarily decrypted and re-encrypted as it is exchanged between the client and backend server. This is known as the WAP Gap. To ensure completely secure communication through the WAP Gap, it is recommended that you use the MobiLink end-to-end encryption feature to further protect data as it passes through the Relay Server. The MobiLink end-to-end encryption feature provides protocol-level encryption between the MobiLink, UltraLite, and QAnywhere clients and the MobiLink server. Both RSA and ECC encryption types are supported. TLS security can be used in combination with end-to-end encryption. See End-to-end encryption.