Re: initiating ftp from IBM i to another place but with a certificate

[Bradley Stone <bvstone@xxxxxxxxx>]

You only need to use an APP ID if you're using a client side certificate.

I am guessing you're not unless your trading partner provided you a
certificate to use...  That's different than the Certificate Authority.

Here's a link to use a client side certificate with GETURI, but it's the
same for any client.
http://www.fieldexit.com/forum/display?threadid=297

Brad
www.bvstools.com

On Thu, Apr 21, 2016 at 7:59 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

> Apparently there's a newer parameter on the ftp command which bears some
> looking into
> Application identifier . . . . . APPID
>
> Application identifier (APPID) - Help
> Specifies the name of the application identifier to use when using
> Secure Sockets Layer (SSL) protection.  The client application
> identifier must be configured in the Digital Certificate Manager
> (DCM) application database.
>
> *DFT
>     The system supplied default client application identifier
>     QIBM_QTMF_FTP_CLIENT is used.
>
> character-value
>     Specify the DCM configured client application ID.  The first
>     character of the application identifier must be an uppercase
>     character ('A' to 'Z'); the remaining characters can be
>     alphanumeric (uppercase 'A' to 'Z' or digits '0' to '9').  You
>     can also use a period ('.') or underscore ('_').
>
>
> So, in DCM, when you view the certificate, and you see:
> Certificate      Common name
> Mycustomer EDI   VN123456
>
> Is the APPID the "Common name"?
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   Rob Berendt <rob@xxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   04/20/2016 04:08 PM
> Subject:        Re: initiating ftp from IBM i to another place but with a
> certificate
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> Ok, We got their certificate into our DCM.
> Now we're at the point where we'd assign the certificate to an
> application.  In this case "IBM i TCP/IP FTP Client".
> Our concern is this:
> One, does this mean all ftp client sessions from this lpar are now
> secured?  Or just ones where you specify an option like SECCNN(*IMPLICIT
> or *SSL)?
> Two, what happens if we get someone else we need to connect to?  Do we add
>
> their certificate also and assign both to "IBM i TCP/IP FTP Client" and it
>
> just chooses the right one to use?
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.