× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Hi Paul

Same issue here two weeks ago for two critical applications. This caused
several hours of downtime
for the applications by the time we diagnose the issue.

As we have no control when customers and or partners update or change the
CA that signed their cert.

I think it would be a great idea to have well know CA's automatically
added by IBM.

Jim

Jim W Grant
Senior VP, Chief Information Officer
Web: www.pdpgroupinc.com




From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 03/19/2018 09:35 AM
Subject: V7R3 DCM Certicate Authority root and intermediate updates
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



We had a 3rd party application update their SSL wildcard cert this past
Saturday.
Our application failed with below errors.

SSL_Handshake() error [IBM -23]: Certificate is not signed by a trusted
certificate authority.
Error 51: SSL peer certificate or SSH remote key was not OK
Closing connection #0
SSL peer certificate or SSH remote key was not OK

Their new cert required us to have the below root and intermediate CA
added to our system store.

DigiCertGlobalRootCA.crt
DigiCertSHA2SecureServerCA.crt

The folks that maintain SSL for our Windows and Linux servers stated these
CA updates are automatic and included with their OS updates.

My doesn't IBM do the same for i?
Have new and updated CAs applied to system store via PTFs.

Or are there any processes/procedures to be more proactive for future SSL
updates?

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.