When using X.509 client certificates as the PAS option, the user authentication takes place using the Secure Sockets Layer (SSL) protocol between the user’s Web browser and the Web server. For this scenario, your system must meet the following prerequisites:

• The ticket-issuing application server must be at least Release 4.6D, patch level 258.
• The ticket-issuing system’s ITS must meet the following release requirements:
• Release 4.6D C4, patch level 172 or higher
• Release 6.10 C1, patch level 2 or higher
• As of Release 6.20, no patch level requirements
• The Web server must be configured to use SSL with mutual authentication. Therefore:
• The Web server must possess a public and private key pair and a corresponding X.509 server certificate that it can use for SSL.
• The user must also possess a public and private key pair and a corresponding X.509 client certificate.
• The user’s Web browser must trust the issuer of the Web server’s certificate.
• The Web server must trust the issuer of the user’s client certificate.
• SNC is required for the connection between the AGate and the ticket-issuing application server.