Re: Configure new Navigator for TLS but doesn't come up on TLS port

Interesting again.  I think for me, using LetEncrypt was the fast path since the CA for LetEncrypt is well known and has been in the Java keystore for quite some time (or maybe I added it long ago). So that may have led to an easier implementation for me.

Good write-up with helpful info.

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java
GIAC Cloud Penetration Tester
AWS Certified Cloud Practitioner
Microsoft Certified: Azure Fundamentals

On 1/17/2024 11:41 AM, Jack Woehr via MIDRANGE-L wrote:

GOT IT WORKING gasp pant phew.

1. I had to add the keystore password manually to
/QIBM/UserData/OS/ADMININST/admin1/wlp/usr/servers/admin1/server.env
- keystore_password=vad_som_helst

I don't know why I had to do this manually, but after I did this, Navigator
came up on 2003 with TLS.

BUT THEN I COULDN'T CONNECT TO THE SERVER FROM iNAVIGATOR! ARGH!

Here's what I discovered.

1. The instructions for using TLS to connect Navigator to the host
server threads are here
<https://www.ibm.com/docs/en/i/7.5?topic=options-setting-up-tls-encryption#rzat10tlsencryption__browser_conn_navigator>
.
2. I had done this prior to setting up Navigator itself for TLS. <<
Don't do this!
3. When TLS is activated for the Navigator itself, apparently only then
the setup for TLS->the host server threads used by iNavigator is activated!
4. The TLS setup for iNavigator itself*uses the DCM keystore*.
5. The TLS setup for iNavigator to connect to the host server threads *uses
the Java keystore*.
6. Our setup has a self signed certificate whose self-signed CA is not
in the Java keystore.
7. So when I activated TLS correctly (by manually adding the DCM
keystore password to server.env) that activated the TLS connection to the
host server threads, which*did not work* because the self-signed
certificate (or its self-signed CA) is not in the Java keystore.

Anyway, I'm up and running now. Thanks everyone for the help and
encouragement!