Re: Certificate authentication through HTTPS

If you're the client, ie you're making the requests, you only need to
import the CAs into the *SYSTEM store, not the entire certificate. There
is a LOT of confusion about that.

They most likely gave you the certificate because:

1. They also don't know what is going on
or
2. They know you can export the CAs from the certificate.

From your initial description it sounds like you are a client. You are

making a request to a server and sending a CSV file to them.

I've put together a bunch of SSL documentation at
http://docs.bvstools.comin the SSL section that helps you export the
CAs and import them into your
*SYSTEM store. It should help.

Brad
www.bvstools.com


On Fri, Sep 6, 2013 at 1:59 PM, Scott Klement
<midrange-l@xxxxxxxxxxxxxxxx>wrote:

The error you posted explicitly means that it couldn't find a matching
CA certificate, so the root/intermediate certs are almost certainly the
problem.

You can't load CA certificates into a particular application (like FTP,
Telnet, SMTP, etc). So I guess I don't understand your question about
"how should he load them". He should load them as CA certificates, not
application certificates. Load the root one first, then the intermediate.

Once he has those loaded, you should create a NEW application ID (do not
use one of the existing ones) named for YOUR application. Maybe
something like MYRON_HTTPS or something... Whatever you want to call it,
but I strongly recommend starting it with your company name so that it
does not conflict with other company's certs. Then load the application
certificate (as a client certificate) directly into that new profile.

Then, use https_init('MYRON_HTTPS') in your RPG program that uses
HTTPAPI so it knows which DCM profile to use.


On 9/6/2013 1:52 PM, Versfelt, Charles wrote:

Hi,

I need to send a CSV through HTTPS from the iSeries, I don't think this

matters to my question but I plan to use HTTPAPI's http_url_post_stmf, I
know that's a topic for a different newsgroup.

The client uses Certificate authentication. The certificate they

provided was a .p12 extension. We have done certificate authentication from
the iSeries in the past, but only with FTP. No one here has much
experience with it. I have none.

We have two technical hurdles I hope someone can help with:

1.) Our Operations VP attempted to load the .p12 Certificate. He

received an error in Work with CA certificates: An error occurred during
certificate validation. The issuer of the certificate may not be in the
certificate store or the issuer may not be enabled.

Both the client and IBM told us we need the Root and Intermediate

certificates. The client provided them, and the VP loaded them. When he
tried to load the .p12 Certificate, the same error reoccurred.

I don't know if the message reoccurrence is related to the second

question. If the Root/Intermediate certificates were loaded incorrectly I
imagine it could cause the problem to continue.

2) The Operations VP incorrectly assumed I was doing FTP and used that

option to load the Certificates. When I told him I was transferring through
HTTPS he told me that's not one of his options in Digital Certificate
Manager. He gave me a print screen that included:

IBM Directory Server publishing
IBM Directory Server client
IBM I TCP/IP FTP Client
IBM I TCP/IP Telnet Client
SNDTWEET by Kisco
IBM I TCP/IP SMTP Client

How should he load the certificates for transferring from the iSeries

via HTTPS?

Might loading those Root/Intermediate certificates with the correct

method for HTTPS usage correct our initial problem of loading the .p12 file?

Any insight I can get on this is much appreciated!

Thanks,
Charlie V.
Myron

This email message has been delivered safely and archived online by

Mimecast. For more information please visit http://www.mimecast.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.