Re: TLS/SSL Certificate update for IBM i ODBC

Actually I'm not sure that's true.

When I was using a self-signed certificate I had to do that.

Once I changed my IBMi SSL to use my GoDaddy certificate the problem magically disappeared for me.

Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx

------------------------------

message: 3
date: Fri, 1 Mar 2024 13:04:51 -0600
from: Justin Taylor <jtaylor.0ab@xxxxxxxxx>
subject: Re: TLS/SSL Certificate update for IBM i ODBC

Yes. AFAIK, you have to intsall the cert on every ODBC client whenever the cert changes. Why does ODBC require it, when 5250 and Apache don't?
That's a good question, and I'd love to know the answer.



date: Fri, 1 Mar 2024 14:50:22 +0000

from: "Sizer, Joseph via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
subject: TLS/SSL Certificate update for IBM i ODBC

Each year I use Digital Certificate Manager (DCM) to import my new SSL
cert. My root and CA cert are still good. I then assign the new SSL
cert to the applications that require them based on what last year's
cert was assigned to. I then verify that telnet, IBM i HTTP servers,
etc. are all using the new SSL cert.

This year, a client PC that uses a System DSN 64-bit ODBC connection
to the IBM I for a Microsoft Word mail merge, generated an error that
defined the SSL cert as not being trusted. I am using ODBC driver IBM
I Access ODBC Driver version 13.64.27.00 and ACS version 1.1.9.4.

The error message generated when testing the connection is:
Data link error: Test connection failed because of an error in
initializing provider. IBM System I Access ODBC Driver Communication
link failure. Comm rc-25414 - CWBCO1050 - The IBM I server
application certificate is not trusted.

Changing the ODBC driver configuration to Non-SSL allows the mail
merge to work (Configure / Connection Options / Security - Do not user
Secured Sockets Layer (SSL)

Telnet (ACS) does not require any update at the PC client level. Is
anyone aware of a requirement where a PC client ODBC connect must run
an update for a new SSL cert? I would like to switch the connection
back to SSL.

Thanks.


Joe Sizer
IBM I Power Systems Administrator
Pencor Digital Services