WND Software
Docs

TLS, certificates and smart cards

WND Terminal encrypts with the operating system’s own TLS library and checks every mainframe certificate. IT decides which certificates count as trusted.

In short

WND Terminal encrypts connections with TLS 1.2 or later from the first byte, using SChannel on Windows and Apple’s Security framework on macOS, both FIPS 140 validated. It checks each mainframe certificate against the computer’s trusted certificates. IT can require encryption and pre-approve certificate fingerprints. It can also stop people from trusting certificates on their own.

ControlSettingEffect
Require encryptionRequireEncryptionEvery connection uses TLS 1.2 or later. The Secure switch is locked on.
Stop self-trusted certificatesAllowUserTrust = falseOnly certificates the computer trusts, or that you list, are accepted.
Pre-approve certificatesTrustedCertificatesSHA-256 fingerprints to accept, such as self-signed ones.
Smart card sign-inSignInWithCertificate, CertificateIssuerSign in with the person’s certificate on every encrypted connection.

Encryption

Turn on Secure in the connection bar to encrypt with TLS 1.2 or later from the first byte. This is the usual secure-port setup, often port 992. In Group Policy, a connection line ending in secure is always encrypted, and 992 is its default port.

WND Terminal carries no cryptography of its own. It uses the operating system’s TLS library, SChannel on Windows and Apple’s Security framework on macOS. Both are FIPS 140 validated.

How certificates are checked

WND Terminal checks the mainframe’s certificate against the computer’s trusted certificates. A certificate from your own certificate authority is accepted once that authority is deployed to the computer.

If the computer doesn’t trust a certificate, which is common with company-issued or self-signed ones, the app shows who it was issued to, by whom, its dates and its SHA-256 fingerprint, and asks the person.

Pinned certificates

When a person trusts a certificate, WND Terminal saves its fingerprint for that host in trusted-certificates.json in the app’s data folder. From then on it accepts only that exact certificate. A changed certificate is refused with a warning. A certificate trusted for the main address is accepted on a backup address only if it’s the very same certificate.

What IT can lock

  • RequireEncryption refuses unencrypted connections.
  • AllowUserTrust = false stops people trusting certificates themselves. Certificates they trusted before are ignored.
  • TrustedCertificates lists SHA-256 fingerprints to trust anyway. The app shows a certificate’s fingerprint when it connects, and your mainframe team can read it from the certificate. Colons are optional.
C6:2F:22:79:A8:9D:36:D9:72:57:05:68:42:92:05:76:F6:CA:6C:36:94:DE:B7:ED:89:96:02:22:D2:C3:80:AC

You can also turn off the mainframe’s unencrypted port, so no one can connect without encryption. In the browser version, people can’t trust a host certificate themselves.

Reconnecting

If the connection drops without the person disconnecting, the session reconnects by itself after 1, 2, 4 and up to 30 seconds. It stays encrypted and says so in the status line. The mainframe sees a new terminal, so people usually log on again.

Smart cards and client certificates

Mainframes set up for client certificates let people sign in with a smart card (CAC, PIV) instead of a password. That means z/OS AT-TLS with HandshakeRole ServerWithClientAuth and the certificate mapped to a RACF user ID. On a secure connection, Sign in offers two choices.

  • With my smart card or a certificate on this computer. This uses the Windows certificate store or a macOS keychain, where a smart card’s certificates appear when it’s inserted. Pick one, or let WND Terminal choose. It picks a certificate that’s valid today and meant for signing in, and it tries a smart card’s certificates first. The operating system asks for the PIN, and the key never leaves the card.
  • With a certificate file (.p12, .pfx). Its password is asked for when connecting and never saved. The file is copied into the app’s client-certificates folder, still protected by its password.

If the host wants a certificate and none was given, or rejects the one sent, the app tells the person what went wrong. The status line shows Certificate when one signed in. Printer sessions sign in the same way as their terminal.

IT can turn this on for everyone with SignInWithCertificate. CertificateIssuer, such as DOD ID CA, picks among several certificates. For one connection only, set SignInWithCertificate on the connection or end its Group Policy line with |smartcard.

Questions

Is WND Terminal's encryption FIPS validated?

WND Terminal has no cryptography of its own. It uses SChannel on Windows and Apple's Security framework on macOS, both FIPS 140 validated.

What happens if a mainframe's certificate changes?

If a person trusted the old certificate, WND Terminal accepts only that exact certificate for the host, so the new one is refused with a warning.

Can people sign in with a CAC or PIV card?

Yes, on mainframes that accept client certificates through z/OS AT-TLS with RACF certificate mapping. The operating system asks for the PIN, and the key never leaves the card.

See it on your own mainframe.

Install WND Terminal on a handful of PCs or Macs, import your sessions and keymaps, and let a real team use it next to what you run today. Free, two to four weeks.

Request a proof of valueTalk to us