× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. April 2013

RE: SSL and public facing web site on the i

Thanks for the information.
I am learning a lot these last 2 days.

Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Dan Kimmel
Sent: Wednesday, April 24, 2013 10:24 AM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

When you request a cert from a CA, a key pair is created. The request goes to the CA with the public key from that pair. When it comes back, it must be unencrypted with the private key from that pair. Then the cert is saved in a cert store on that machine. Doesn't actually have to be the same machine, but does have to have the key pair that was created when the request for a cert from the CA was created. So you could move the cert store from the requesting machine to your IBMi and receive the reply from the CA there.

Probably simpler to handle the reply from the CA on the machine where the request was made and export the cert from the cert store on that machine and then import it to the cert store on the IBMi.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Therrien
Sent: Wednesday, April 24, 2013 9:44 AM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

Ok, before anyone spends any more time on this. I have been informed that we will be running the web site under a different domain name and therefore we are going to have to get a new certificate anyway.

But if anyone has any insight into how to resolve the original issue, I would be curious to know if there is a way to use the certificate for our original domain on the I if the I was serving up web pages under the original domain.

Thanks once again.

Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Therrien
Sent: Wednesday, April 24, 2013 9:12 AM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

Now that I have the CA certificate installed I want to install the actual certificate.
Now I am getting this new error:

"No request key is found for the certificate. If you are trying to receive the signed certificate, you must be using the same certificate store that was used when the certificate was requested. If this is a CA certificate, you should use the function for importing a CA."

The original certificate request went out from a different server at an earlier time.
The questions are:
1. Is there a way to install this certificate on the I, even though the request was from a different server?
2. Do I need to request a new certificate for the I even though the I is on the same domain that the original certificate was requested for?

Any help appreciated again.

Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bradley Stone
Sent: Tuesday, April 23, 2013 3:42 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL and public facing web site on the i

If needed, you can always strip CAs out of a certificate without needing to go to the source for it. If you have a certificate, you have the CAs.

I've documented this since it's an every day occurrence for my customers.

http://docs.bvstools.com/home/ssl-documentation

Brad
www.bvstools.com


On Tue, Apr 23, 2013 at 3:14 PM, Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>wrote:

Early results.

I went to the Go Daddy site and found their Certificate Chain and
their "Go Daddy Class 2 Certification Authority Root Certificate" (DER
Format) file and was able to successfully import it to the DCM.
Go Daddy is now a CA on the IBM i.

I will let you know if I get the certificate working as desired.

My thanks to everyone for the help so far. More to come.

Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Fenstermacher
Sent: Tuesday, April 23, 2013 1:40 PM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

If I'm understanding what you're problem is it's exactly what I'm
working on now and here's a very good article with information about the problem.

http://www.itjungle.com/fhg/fhg041713-story03.html


Paul Fenstermacher | Sys/NW Admin,Sr | Corporate Systems - POWER
Systems Administration | Jack Henry & Associates, Inc.(r)
663 West Highway 60 | Monett, MO 65708 | Ph. 417.235.6652 | x177389 |
pfenstermacher@xxxxxxxxxxxxx


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Therrien
Sent: Tuesday, April 23, 2013 1:28 PM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i

Nathan,

The desire for SLL is exactly as you state - to encrypt communications
of user ids and passwords and company data.
The issue that I feel I am having with SSL is my lack of understanding
of how to setup the web server with our public certificate.
When I attempt to install the CA certificate on the I, I get the
following error from the Digital Certificate Manager:
"An error occurred during certificate validation. The issuer of the
certificate may not be in the certificate store or the issuer may not
be enabled. "
There are 2 .crt files to install one appears to be the Certificate
for the CA and the other is the certificate for our domain.
The big issue is my lack of understanding - both of the SSL
installation and the Apache configuration.


Paul

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Nathan Andelin
Sent: Tuesday, April 23, 2013 12:59 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL and public facing web site on the i

Paul,

SSL only encrypts streams exchanged between the browser and the HTTP
server; it doesn't protect the database or other server objects, per se.
However you can be confident in exposing the IBM i Apache server to
the Internet if you configure it appropriately. The good news is that
the Apache server disallows access to everything by default. You must
explicitly expose resources via HTTP configuration directives.

If you have SSL working internally, the same configuration for SSL
probably works for external users as well. However I suspect that the
real problem is that you're unsure about Apache server configuration,
in general. You may want to have an expert review your Apache configuration.

-Nathan




----- Original Message -----
From: Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion (midrange-l@xxxxxxxxxxxx)"
< midrange-l@xxxxxxxxxxxx>
Cc:
Sent: Tuesday, April 23, 2013 9:38 AM
Subject: SSL and public facing web site on the i

Our company has a public web address and a GoDaddy certificate that
we currently use for SSL to our webmail that is hosted on an exchange server.
We are developing our first www facing site on the IBM I and want to
secure it with SSL. I have made a few stabs at trying to get SSL
configured correctly and have managed to get a local CA in place on
the IBM I and open the web site internally using SSL. But I am lost
as to how to configure SSL and the Apache server on the I.
I am a great (IMHO) software guy, but I am a newbie on web infrastructure.
What do I need to do to allow our web site on the I to be accessible
from the internet via our www domain and to incorporate the SLL
certificate that we have purchased from GoDaddy?

I appreciate your help.

Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at http://archive.midrange.com/midrange-l.

NOTICE: This electronic mail message and any files transmitted with it
are intended exclusively for the individual or entity to which it is addressed.
The message, together with any attachment, may contain confidential
and/or privileged information.
Any unauthorized review, use, printing, saving, copying, disclosure or
distribution is strictly prohibited. If you have received this message
in error, please immediately advise the sender by reply email and
delete all copies.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.