Encryption in SAS 9.4, Sixth Edition
Total Page:16
File Type:pdf, Size:1020Kb
Encryption in SAS® 9.4, Sixth Edition SAS® Documentation July 31, 2020 The correct bibliographic citation for this manual is as follows: SAS Institute Inc. 2016. Encryption in SAS® 9.4, Sixth Edition. Cary, NC: SAS Institute Inc. Encryption in SAS® 9.4, Sixth Edition Copyright © 2016, SAS Institute Inc., Cary, NC, USA All Rights Reserved. Produced in the United States of America. For a hard copy book: No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, or otherwise, without the prior written permission of the publisher, SAS Institute Inc. For a web download or e-book: Your use of this publication shall be governed by the terms established by the vendor at the time you acquire this publication. The scanning, uploading, and distribution of this book via the Internet or any other means without the permission of the publisher is illegal and punishable by law. Please purchase only authorized electronic editions and do not participate in or encourage electronic piracy of copyrighted materials. Your support of others' rights is appreciated. U.S. Government License Rights; Restricted Rights: The Software and its documentation is commercial computer software developed at private expense and is provided with RESTRICTED RIGHTS to the United States Government. Use, duplication, or disclosure of the Software by the United States Government is subject to the license terms of this Agreement pursuant to, as applicable, FAR 12.212, DFAR 227.7202-1(a), DFAR 227.7202-3(a), and DFAR 227.7202-4, and, to the extent required under U.S. federal law, the minimum restricted rights as set out in FAR 52.227-19 (DEC 2007). If FAR 52.227-19 is applicable, this provision serves as notice under clause (c) thereof and no other notice is required to be affixed to the Software or documentation. The Government’s rights in Software and documentation shall be only those set forth in this Agreement. SAS Institute Inc., SAS Campus Drive, Cary, NC 27513-2414 August 2020 SAS® and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. ® indicates USA registration. Other brand and product names are trademarks of their respective companies. 9.4-P11:secref Contents About This Book . vii What's New in Encryption in SAS 9.4 . xiii PART 1 Encryption in SAS 9.4 1 Chapter 1 / Technologies for Encryption . 3 Overview of Encryption . 3 FIPS 140-2 Standards Compliance . 5 Providers of Encryption . 6 Encryption Algorithms . 20 Comparison of Encryption Technologies . 22 Encryption: Implementation . 23 Encryption: SAS Logging Facility . 23 Encrypting ODS Generated PDF Files . 25 Chapter 2 / SAS System Options for Encryption . 27 PROC HTTP Can Use TLS System Options Locally . 27 Dictionary . 28 Chapter 3 / SAS Environment Variables . 57 Overview of Environment Variables . 57 Dictionary . 58 Chapter 4 / PWENCODE Procedure . 65 Overview: PWENCODE Procedure . 65 Concepts: PWENCODE Procedure . 66 Syntax: PWENCODE Procedure . 67 Examples: PWENCODE Procedure . 70 Chapter 5 / Encryption Technologies: Examples . 75 SAS Proprietary Encryption for SAS/SHARE: Example . 76 SAS/SECURE for SAS/CONNECT: Example . 76 TLS for a SAS/CONNECT UNIX Spawner: Example . 77 TLS for a SAS/CONNECT Windows Spawner: Example . 80 TLS on a z/OS Spawner on a SAS/CONNECT Server: Example . 82 TLS for SAS/SHARE on UNIX: Example . 85 TLS for SAS/SHARE on Windows: Examples . 86 TLS for SAS/SHARE on z/OS: Example . 88 SSH Tunnel for SAS/CONNECT: Example . 89 SSH Tunnel for SAS/SHARE: Example . 90 iv Contents PART 2 Installing and Configuring TLS and Certificates Chapter 6 / Certificates Explained . 95 About Certificates . 95 Certificate File Formats . 96 Overview of CA Certificate Management Using the SAS Deployment Manager . 98 Best Practices When Generating Certificates . 99 Certificate Implementation: How TLS Client and Servers Negotiate . 100 How SAS Validates Certificates between Clients and Servers . 101 Chapter 7 / Installing and Configuring TLS and Certificates on UNIX . 103 TLS on UNIX: System and Software Requirements . 103 Certificate Locations . 104 Preparation for Setting Up Digital Certificates . 105 Generate Digital Certificates Using OpenSSL . 106 Convert between PEM and DER File Formats Using OpenSSL . 114 Convert PEM Files to a PFX File Using OpenSSL . 115 Manage Certificates in the Trusted CA Bundle Using the SAS Deployment Manager . 115 Add Your Certificates to the SAS Private JRE . 121 How Clients and Servers Validate Certificates . 123 Building FIPS 140-2 Capable OpenSSL on UNIX . 124 Chapter 8 / Installing and Configuring TLS and Certificates on Windows . 127 Steps to Add Certificates for TLS to Windows . 127 TLS on Windows: System and Software Requirements . 128 Configure TLS and Request Digital Certificates on Windows . 129 Add Your Certificates to the Windows CA Store . 132 Import the Client Certificate into the Windows Personal Machine Store . 133 Convert between PEM and DER File Formats for TLS . 134 Use the SAS Deployment Manager to Manage Certificates in the Trusted CA Bundle . 135 Validating Certificates between Clients and Servers . 135 Configure FIPS 140-2 Capable TLS on Windows . 136 Chapter 9 / Installing and Configuring TLS and Certificates on z/OS . 137 TLS on z/OS: System and Software Requirements . 137 TLS on z/OS: Setting Up Digital Certificates . 138 Use the SAS Deployment Manager to Manage Certificates in the Trusted CA Bundle . 143 PART 3 Troubleshooting Chapter 10 / Troubleshooting . 147 ERROR: Unable to load extension: (tkessl) . 147 ERROR: SSL provider not in FIPS mode . 147 ERROR: HTTP proxy handshake failed . 147 ERROR: Cannot load SSL Support . 148 ERROR:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE: certificate verify failed . 148 Failed to Find the Following Issuer of This Certificate in Truststore . 148 Contents v Verify That the File Contains Certificates in the Proper Encoding . 149 ERROR: Cannot negotiate encryption algorithm . 149 TLS Certificate Verification: ERROR, Certificate Has Expired . 150 PART 4 Appendices Appendix 1 / Environment Variables Appendix . 153 Overview . ..