Requirements and known limitations of YSoft SafeQ Embedded Terminal for Sharp

General notes

  • Embedded Terminal is a software extension of Sharp devices.  

  • Without the EAM module, Scan management is not available and a print job list is not refreshed after print.

  • Embedded Terminal requires licensed and configured Sharp OSA Platform (ACM and EAM module) at the device (OSA version 3.5 and higher).

  • YSoft SafeQ Embedded Terminal for Sharp - 2nd Gen. is supported only on Sharp OSA Platform 5 and higher

    • Devices with Sharp OSA Platform 4.5 and lower might work as well but were not tested and are not officially supported. 

  • CR5 device line with Sharp OSA Platform 6 does not support YSoft SafeQ Embedded Terminal for Sharp - 1st Gen. 

    • Use YSoft SafeQ Embedded Terminal for Sharp - 2nd Gen instead.

Known limitations

  • Logout with a card is not possible when the card reader is in keyboard mode.

  • Logout with a card is not possible when the device is not fully unlocked (the user did not enter the copy or scan applications after logging in).

  • The initial-screen property is only supported on devices with OSA 4 and higher.

  • If the MFP device is asleep, the user must start the device manually before swiping the card at the USB card reader.

  • When the user credential (i.e. user name, password) are not filled in, the Login button is active, but it does not make any action.

  • Print is not supported for users with username "admin", "blankuser", "service", "users", "other", "other2", "system", "invalid", "vendor", "vendor2" and "servicefss" as these are internally reserved words.

  • In case of changing AMX2/3 license keys, Terminal Server must be restarted before installation of ET.

  • In IC Card Mode enabled on the device and Sharp mode set on the USB card reader swiping the card causes occasional blinking of the display.

  • The Authentication feature has to be installed with the mode set to To device when both AMX2 and AMX3 licenses are enabled.

Finishing options:

  • Proper functionality of Advanced Finishing options is guaranteed only when using one of YSoft Universal Print Drivers.

  • The following options are not supported: 3-punching and top punching, staple-right, half-folding, and Page Range.

  • Not all Finishing options are supported on every device, for detailed information please see the Hardware Compatibility List (HCL)

Payment System:

  • YSoft SafeQ Payment System is not supported on devices without AMX 3 license.

  • The print/copy operation may not stop immediately once the minimal balance is reached. Depending on the device, there can be a small delay that allows the users to overrun their balance by about 4 pages. Therefore, registration of debt has to be allowed in YSoft SafeQ Payment System. Otherwise, user would be able to continue printing and copying even after using up credit.

  • When the job is suspended due to insufficient funds, the following behavior differs depending on the supported OSA version.

    • OSA version < 4.0 It is not possible to print, copy or scan on the device, unless the suspended job is manually deleted.

    • OSA version ≥ 4.0 Suspended scan and copy jobs are automatically deleted; Print jobs are stopped and waiting for user input (retry / delete).

  • If more jobs are printed in one batch, it might happen that the following jobs are suspended even though the user has enough credit.

    • The reason for this is that the quota calculation for the next job is done before the accounting information from the previous is sent.

    • The suspended jobs can be released on the "Limits" native screen, here it is possible to select the suspended job and re-check the limits. After confirmation, the job is released.

Quotas:

  • It is not possible to use a quota defined as PRINT or COPY (without color specification). Only definitions like PRINT COLOR or COPY BW are allowed.

  • Print all or print more jobs – it is possible that not all jobs are printed. It depends on the balance of quotas. The strategy for reservation is the same as for credit handling.

    • Balance < 100 – the whole quota is reserved (jobs have to be printed one by one)

    • Balance ≥ 100 – half of the quota is reserved (jobs can be printed in batches)

  • It is possible, that the device will copy or print up to 3 pages more than allowed by quotas. Therefore, users can end up with a negative quota limit.

Differences and limitations of AMX2 and AMX3 licensing

AMX2 license only

  • The Authentication feature has to be installed with the mode set to To each application.

  • Authentication is not required for copying.

  • The authentication screen is displayed after pressing the Sharp OSA button.

  • Copy and scan jobs are not visible in the YSoft SafeQ management interface.

  • Copy, scan, and print jobs are not visible on the history screen.

  • Accounting is not available.

  • After installation, log out and after canceling card assignment or authentication, the user is navigated to screen “Select external application”.

  • In the case that the Authentication Mode is configured "To each application", the USB IC Card mode is not working (the USB keyboard mode must be configured).

AMX3 license only 

  • After authentication user is navigated directly to the embedded terminal application (The initial-screen property has to be set to sqprint).

  • Return to the embedded terminal from Sharp native screen is not possible.

  • Scanning is not available.

Both AMX2 and AMX3 licenses 

  • In the case that both licenses are enabled (AMX2, AMX3) and the user login, he is taken to the Sharp OSA native panel (not directly to the YSoft SafeQ application).

  • The Authentication feature has to be installed with the mode set to To device.


Differences and limitations of OSA 6.5 devices

In OSA 6.5 devices, several security hardening mechanisms were implemented to the MFP factory default configuration. The connections accepted by this model are secured exclusively via TLS 1.3 or very limited TLS 1.2, with verification of the certificate signature.

In order to allow installation and operation of the terminal, following changes need to be done:

  • within MFP Web UI:

    • in System Settings > Security Settings > SSL/TLS Settings uncheck Verify Signature of Server Certificate of the Other Party checkbox if the default SafeQ certificate is used or install the certificate authority to the device.

  • on the server:

    • Windows Server versions below 2022 support TLS 1.2 as maximum. Only ECDSA based certificates are accepted by the device, i.e. Terminal Server service must use it; please refer to Configuring secured connection between terminals and Terminal Server.

      • Following openssl/keytool commands may be used to generate custom CA-signed certificate.
        keytool -genkeypair -keyalg EC -groupname secp256r1 -sigalg SHA256withECDSA -alias ca -keystore ca.jks -validity 3650 -keypass "yourpassword" -storepass "yourpassword" -dname "CN=ECDSA root" -ext BC=ca:true,pathlen:1

        keytool -exportcert -rfc -keystore ca.jks -alias ca -file ca.crt -storepass "yourpassword"

        openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -pkeyopt ec_param_enc:named_curve -out "ec.csr" -keyout "ec.key" -passout "pass:yourpassword" -subj "//CN=serveraddress"

        keytool -gencert -rfc -keystore ca.jks -alias ca -storepass yourpassword -validity 365 -outfile "ec.crt" -infile "ec.csr" -ext BC=ca:false -ext "SAN=ip:serveraddress"

        openssl pkcs12 -export -inkey "ec.key" -in "ec.crt" -out "ec.pfx" -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider" -passin "pass:yourpassword" -passout "pass:yourpassword" -chain -CAfile "ca.crt" -caname "ca"

    • Windows Server 2022 and higher - TLS 1.3 can be used for connections initiated by the device, but there is known issue with this protocol version for outbound connections to Sharp OSA devices. We currently recommend setting outbound connections to TLS 1.2 via configuration option securityProtocolTypesForOutboundCommunication.