Re: SSL and public facing web site on the i

[Bradley Stone <bvstone@xxxxxxxxx>]

If needed, you can always strip CAs out of a certificate without needing to
go to the source for it.  If you have a certificate, you have the CAs.

I've documented this since it's an every day occurrence for my customers.

http://docs.bvstools.com/home/ssl-documentation

Brad
www.bvstools.com


On Tue, Apr 23, 2013 at 3:14 PM, Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>wrote:

> Early results.
>
> I went to the Go Daddy site and found their Certificate Chain and their
> "Go Daddy Class 2 Certification Authority Root Certificate" (DER Format)
> file and was able to successfully import it to the DCM.
> Go Daddy is now a CA on the IBM i.
>
> I will let you know if I get the certificate working as desired.
>
> My thanks to everyone for the help so far.  More to come.
>
> Paul
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
> midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Fenstermacher
> Sent: Tuesday, April 23, 2013 1:40 PM
> To: Midrange Systems Technical Discussion
> Subject: RE: SSL and public facing web site on the i
>
> If I'm understanding what you're problem is it's exactly what I'm working
> on now and here's a very good article with information about the problem.
>
> http://www.itjungle.com/fhg/fhg041713-story03.html
>
>
> Paul Fenstermacher | Sys/NW Admin,Sr  | Corporate Systems - POWER Systems
> Administration | Jack Henry & Associates, Inc.®
> 663 West Highway 60 | Monett, MO 65708 | Ph. 417.235.6652 | x177389 |
> pfenstermacher@xxxxxxxxxxxxx
>
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
> midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Therrien
> Sent: Tuesday, April 23, 2013 1:28 PM
> To: Midrange Systems Technical Discussion
> Subject: RE: SSL and public facing web site on the i
>
> Nathan,
>
> The desire for SLL is exactly as you state - to encrypt communications of
> user ids and passwords and company data.
> The issue that I feel I am having with SSL is my lack of understanding of
> how to setup the web server with our public certificate.
> When I attempt to install the CA certificate on the I, I get the following
> error from the Digital Certificate Manager:
> "An error occurred during certificate validation. The issuer of the
> certificate may not be in the certificate store or the issuer may not be
> enabled. "
> There are 2 .crt files to install one appears to be the Certificate for
> the CA and the other is the certificate for our domain.
> The big issue is my lack of understanding - both of the SSL installation
> and the Apache configuration.
>
>
> Paul
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
> midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Nathan Andelin
> Sent: Tuesday, April 23, 2013 12:59 PM
> To: Midrange Systems Technical Discussion
> Subject: Re: SSL and public facing web site on the i
>
> Paul,
>
> SSL only encrypts streams exchanged between the browser and the HTTP
> server; it doesn't protect the database or other server objects, per se.
> However you can be confident in exposing the IBM i Apache server to the
> Internet if you configure it appropriately. The good news is that the
> Apache server disallows access to everything by default. You must
> explicitly expose resources via HTTP configuration directives.
>
> If you have SSL working internally, the same configuration for SSL
> probably works for external users as well. However I suspect that the real
> problem is that you're unsure about Apache server configuration, in
> general. You may want to have an expert review your Apache configuration.
>
> -Nathan
>
>
>
>
> ----- Original Message -----
> From: Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>
> To: "Midrange Systems Technical Discussion (midrange-l@xxxxxxxxxxxx)" <
> midrange-l@xxxxxxxxxxxx>
> Cc:
> Sent: Tuesday, April 23, 2013 9:38 AM
> Subject: SSL and public facing web site on the i
>
> Our company has a public web address  and a GoDaddy certificate that we
> currently use for SSL  to our webmail that is hosted on an exchange server.
> We are developing our first www facing site on the IBM I and want to
> secure it with SSL.  I have made a few stabs at trying to get SSL
> configured correctly and have managed to get a local CA in place on the IBM
> I and open the web site internally using SSL.  But I am lost as to how to
> configure SSL and the Apache server on the I.
> I am a great (IMHO) software guy, but I am a newbie on web infrastructure.
> What do I need to do to allow our web site on the I to be accessible from
> the internet via our www domain and to incorporate the SLL certificate that
> we have purchased from GoDaddy?
>
> I appreciate your help.
>
> Paul
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at http://archive.midrange.com/midrange-l.
>
> NOTICE: This electronic mail message and any files transmitted with it are
> intended exclusively for the individual or entity to which it is addressed.
> The message, together with any attachment, may contain confidential and/or
> privileged information.
> Any unauthorized review, use, printing, saving, copying, disclosure or
> distribution is strictly prohibited. If you have received this message in
> error, please immediately advise the sender by reply email and delete all
> copies.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.