Re: FTP client switch certificates workaround

Why couldn't you just assign the FTP client to use a
specific store (like the *SYSTEM store) instead of a
particular CA?  That seems like a good solution as well.

Assinging different application IDs is of course another
thing that should already be implemented.

Brad
www.bvstools.com


On Mon, 1 May 2006 11:49:20 -0400
 craigs@xxxxxxxxx wrote:
> 
> I received a positive response from IBM about allowing
> more than one secure
> remote host with the FTP client.  Here is their reponse
> with sensitive
> information removed for this list.  The only thing you
> need to know for
> contact info is the contact name for undocumented APIs is
> Bruce Vining.  He
> can also answer questions about the undocumented APIs.
>  Ask IBM for more
> information.
> 
>  "We have seen this issue before where people connect as
> an SSL FTP client
> to different servers needing two different digital
> certificates and people
> have to go into Digital Certificate Manager and unassign
> one certificate to
> the FTP client and assign the other certificate to the
> FTP client.
> 
> After many discussions back and forth with development
> about not being able
> to assign more than one certificate to the FTP client, we
> now have a viable
> solution. There is an unpublished API called 'Update
> Certificate Usage'
> that we can give to you to be able to switch certificate
> assignments
> programmatically.  The reason this API is unpublished is
> that it was only
> meant to be used by our DCM GUI and development reserves
> the right to
> change the API without telling anyone.  In order for you
> to receive details
> about this unpublished API you need to contact the
> following person in
> order to fill out a 'Document of Understanding' form
> (essentially a release
> form):
> 
> Bruce Vining
> 
> Also, on a positive note, development will be looking
> into possibly making
> some changes within the FTP command to be able to specify
> an Application
> ID.  This way we could create as many App IDs as we need
> in DCM and tell
> FTP to use whichever one we need."
> 
> I emailed Bruce.  This should allow us to at least hang
> on for awhile and
> not get caught without a production working solution.  It
> is good to see a
> plan in place for this in the future.  FTPAPI will
> probably also have this
> type of functionality in the future as it is in the
> refining stage but may
> or may not have FTP script support then (just API
> procedures for each
> function on an RPG program by program basis).
> 
> Craig Strong
> 
> -- 
> This is the Midrange Systems Technical Discussion
> (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/midrange-l.
> 

Bradley V. Stone
BVS.Tools
www.bvstools.com