Using a server-side certificate, a client communicating with the Relay Server can verify the web server that is running the Relay Server is a trusted server. The client verifies the web server's public certificate with the root certificate stored on the client. If the certificates are verified, a key exchange occurs to establish the encrypted connection.

Using a client-side certificate, the web server can verify that a client communicating with the Relay Server is a trusted client. The web server verifies the client's public certificate with its root certificate stored in the certificate manager on the web server computer. If the certificates are verified, a key exchange occurs to establish the encrypted connection.

The rs.config file is used by the Relay Server to define the peer list of Relay Servers, if running in a farm environment, including the back-end farm and back-end server configurations. Each Relay Server in the environments needs to maintain a copy of the rs.config file.

The configuration of the back-end farm and back-end servers ensures the Relay Server only communicates with computers with which it has been configured. Any attempted communication with computers for which the Relay Server has not been configured will be refused.

The back-end farm can be configured to specify the level of communication security when accepting requests from the clients and the RSOE. There is a client_security and backend_security option that allows the back-end farm to specify the type of communication that can be established. This option is specified as follows:

The RSOE establishes the connection between the back-end server and the Relay Server using three phases: 1) startup phase, 2) ready phase 3) working phase.

In the backend server section of the rs.config file, each server that exists in the back-end farm is configured with an ID and associated farm name. The ID corresponds to the server name. The Relay Server has the ability to verify the MAC address of the computer running the RSOE to ensure the server communicating from within the internal firewall is trusted and allowed to establish a connection with the Relay Server. The MAC property is the MAC address of the network adapter used by the RSOE. The address is specified in IEEE 802 MAC-48 format.

The backend server section also allows for the configuration of a security token that is used by the Relay Server to authenticate the back-end server connection. The token must be provided upon startup of the RSOE when establishing the connection with the Relay Server.

The MobiLink client uses HTTP or HTTPS to communicate with the Relay Server. With HTTPS communication, data is temporarily decrypted and re-encrypted as it is exchanged between the client and back-end server. This is known as the WAP Gap. To ensure completely secure communication through the WAP Gap, it is recommended that you use the MobiLink end-to-end encryption feature to further protect data as it passes through the Relay Server. The MobiLink end-to-end encryption feature provides protocol-level encryption between the MobiLink, UltraLite, and QAnywhere clients and the MobiLink server. Both RSA and ECC encryption types are supported. TLS security can be used in combination with end-to-end encryption.

For security purposes, when using the standalone outbound enabler, the HTTP listening port of the back-end server should be explicitly bound only to the loopback IP address (127.0.0.1).

• Relay Server configuration file
• Windows IIS  http://www.sybase.com/detail?id=1059277
• Apache  http://www.sybase.com/detail?id=1065869
• End-to-end encryption