Re: SSL and public facing web site on the i

If needed, you can always strip CAs out of a certificate without needing to
go to the source for it. If you have a certificate, you have the CAs.

I've documented this since it's an every day occurrence for my customers.

http://docs.bvstools.com/home/ssl-documentation

Brad
www.bvstools.com


On Tue, Apr 23, 2013 at 3:14 PM, Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>wrote:

Early results.

I went to the Go Daddy site and found their Certificate Chain and their
"Go Daddy Class 2 Certification Authority Root Certificate" (DER Format)
file and was able to successfully import it to the DCM.
Go Daddy is now a CA on the IBM i.

I will let you know if I get the certificate working as desired.

My thanks to everyone for the help so far. More to come.

Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Fenstermacher
Sent: Tuesday, April 23, 2013 1:40 PM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

If I'm understanding what you're problem is it's exactly what I'm working
on now and here's a very good article with information about the problem.

http://www.itjungle.com/fhg/fhg041713-story03.html


Paul Fenstermacher | Sys/NW Admin,Sr | Corporate Systems - POWER Systems
Administration | Jack Henry & Associates, Inc.®
663 West Highway 60 | Monett, MO 65708 | Ph. 417.235.6652 | x177389 |
pfenstermacher@xxxxxxxxxxxxx


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Therrien
Sent: Tuesday, April 23, 2013 1:28 PM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

Nathan,

The desire for SLL is exactly as you state - to encrypt communications of
user ids and passwords and company data.
The issue that I feel I am having with SSL is my lack of understanding of
how to setup the web server with our public certificate.
When I attempt to install the CA certificate on the I, I get the following
error from the Digital Certificate Manager:
"An error occurred during certificate validation. The issuer of the
certificate may not be in the certificate store or the issuer may not be
enabled. "
There are 2 .crt files to install one appears to be the Certificate for
the CA and the other is the certificate for our domain.
The big issue is my lack of understanding - both of the SSL installation
and the Apache configuration.


Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Nathan Andelin
Sent: Tuesday, April 23, 2013 12:59 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL and public facing web site on the i

Paul,

SSL only encrypts streams exchanged between the browser and the HTTP
server; it doesn't protect the database or other server objects, per se.
However you can be confident in exposing the IBM i Apache server to the
Internet if you configure it appropriately. The good news is that the
Apache server disallows access to everything by default. You must
explicitly expose resources via HTTP configuration directives.

If you have SSL working internally, the same configuration for SSL
probably works for external users as well. However I suspect that the real
problem is that you're unsure about Apache server configuration, in
general. You may want to have an expert review your Apache configuration.

-Nathan




----- Original Message -----
From: Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion (midrange-l@xxxxxxxxxxxx)" <
midrange-l@xxxxxxxxxxxx>
Cc:
Sent: Tuesday, April 23, 2013 9:38 AM
Subject: SSL and public facing web site on the i

Our company has a public web address and a GoDaddy certificate that we
currently use for SSL to our webmail that is hosted on an exchange server.
We are developing our first www facing site on the IBM I and want to
secure it with SSL. I have made a few stabs at trying to get SSL
configured correctly and have managed to get a local CA in place on the IBM
I and open the web site internally using SSL. But I am lost as to how to
configure SSL and the Apache server on the I.
I am a great (IMHO) software guy, but I am a newbie on web infrastructure.
What do I need to do to allow our web site on the I to be accessible from
the internet via our www domain and to incorporate the SLL certificate that
we have purchased from GoDaddy?

I appreciate your help.

Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.

NOTICE: This electronic mail message and any files transmitted with it are
intended exclusively for the individual or entity to which it is addressed.
The message, together with any attachment, may contain confidential and/or
privileged information.
Any unauthorized review, use, printing, saving, copying, disclosure or
distribution is strictly prohibited. If you have received this message in
error, please immediately advise the sender by reply email and delete all
copies.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.