In later releases of OS/390, the TN3270 server that is part of Communication Server supports SSL. IBM's Personal Communciations (a.k.a. PCOM), V4.3 and up, supports SSL. If you want you can use Host On-Demand which also supports SSL. If you have standardized on one or two vendors' emulators take a peek at their documentaion.
For example, see WRQ's Reflection for IBM downloadable at http://www.wrq.com/assets/products_0808.pdf.
This was first published in September 2003