Re: Client Access Certificate Authority

[Wayne McAlpine <wayne.mcalpine@xxxxxxxxxxxxxxxxx>]

As is usually the case, it was operator error causing the problem.  I 
neglected to perform the step to validate the certificate after I 
renewed it.  Once I did that, it came up fine.  It is not necessary to 
restart the server to use the new certificate.

Thanks all for your help.

Wayne McAlpine wrote:
> Chris, thanks for the suggestion.  There really is no restart option on 
> Telnet server like there is for HTTP.  I'm having them re-ipl tonight so 
> hopefully I'll be back up tomorrow.  BTW, we use a Verisign certificate 
> for the web site, which is why I was able to get into the certificate 
> manager.
>
> Chris Bipes wrote:
> > As Justin C. Haase pointed out you must restart your telnet server to
> > pick up the new certificate.  **WARNING** you may loose all established
> > connections, SSL or not.  You should just be able to type the command
> > from a 5250 session STRTCPSVR *TELNET and have it restart with the new
> > SSL Cert without ending established connections.  This should then
> > pickup the new cert.  If it does not, you will have to end and restart
> > which will drop all connections, secure or not.
> >
> > You can check your certificate by HTTPS://YourIPAddress:992  The browser
> > will display garbage but you should have a padlock in IE to show you the
> > certificate.
> >
> >
> > Christopher Bipes
> > Information Services Director
> > CrossCheck, Inc.
> >
> > -----Original Message-----
> > From: midrange-l-bounces@xxxxxxxxxxxx
> > [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Wayne McAlpine
> > Sent: Monday, January 08, 2007 9:24 AM
> > To: midrange-l@xxxxxxxxxxxx
> > Subject: Client Access Certificate Authority
> >
> > I've run out of ideas on how to get my SSL emulator connection working
> > again and I'm hoping someone can shed some light on the problem.
> >
> > I have been running telnet sessions using a local certificate that was
> > created on the AS/400 three years ago.  This morning, the certificate
> > expired, so I went in using Certificate Manager and renewed the
> > certificate.  My recollection was that that was all that should have
> > been necessary to re-establish communications, but that turned out not
> > to be the case.  The sessions were still rejected.
> >
> > Then I did a cut and paste of the certificatedata and re-installed that
> > using the key management utility in Client Access.  Still no luck.  When
> > I try to verify the SSL connection in Ops Navigator, all of the services
> > fail.  The telnet error message is that the AS/400 is not a trusted
> > site.
> >
> > Anyone have any suggestions?