RE: Using a Verisign certificate for SSL

John (and all), I copied this all in with the exception that I changed
SSLEngine On to SSLEngine Optional (this address needs to accept non-SSL
requests as well).  Also, my Listen directives come much higher in the file,
but they are both there.

Anyway, as far as I can tell, this is the only error I get (it's in the
error log in /www/instance/logs):

ZSRV_MSG0017: Method in request XXXX not valid.

The XXXX is the Euro sign, the letter L and two boxes.  After looking in the
access logs, it tells me that the request is X'804C0103', which seems to be
a fairly normal SSL request (not that I know, but looking up 80 4c 01 03 in
Google got me several hits dealing with SSL).

So somehow I'm still not getting it.  There is one other area that might
have to do with it, the application definition.  If I go into DCM and I look
at the application QIBM_HTTP_SERVER_MYINSTANCE, I see the following:

-------
Exit program information
   Exit program: QZHBDCME
   Exit program library: QHTTPSVR
   Threadsafe: Not known
   Multithreaded job action: Run program and send message

Application user profile: *NONE
Define the CA trust list: Yes
Client authentication supported: No
Client authentication required: No
Certificate Revocation List (CRL) checking: No
-------

One last bit of ugliness has to do with the iSeries host table.  The host
table has entries for APP.MYCOMP.COM which points to the iSeries, and
another entry of just MYCOMP.COM which points to the mail server (not the
iSeries), which is used to forward mail.  I've tried APP.MYCOMP.COM as well
as the IP address, neither works.  I wonder if that mail server entry is
confusing SSL?

Joe 


> From: Jones, John (US)
> 
> Does your httpd.conf file have the following?
> 
> LoadModule ibm_ssl_module /QSYS.LIB/QHTTPSVR.LIB/QZSRVSSL.SRVPGM
> SSLEngine On
> SSLAppName QIBM_HTTP_SERVER_xxxxxxxx
> SSLCacheEnable
> SSLVersion TLSV1_SSLV3
> SetEnv HTTPS_PORT 443
> ...
> Listen ww.xx.yy.zz:443
> 
> Where xxxxxxxx is your server instance name and ww.xx.yy.zz is the IP
> address.
> 
> Also, are you accessing the site by DNS name or by IP address?  Try
> accessing via the DNS name.
> 
> The above is from our config and we are using a Verisgn certificate.  We
> are not, BTW, using a virtual host.