Re: SSL certificates for applications

[Bradley Stone <bvstone@xxxxxxxxx>]

You should only need to make the connection on your wintel server SSL.
Then just import the CAs from the SSL certificate on the wintel server on
your IBM i using DCM.

See here:
http://docs.bvstools.com/home/ssl-documentation

Where you get the server certificate is up to you.  You could even make a
self-signed one on your IBM i.

You can go one step further and use a client side SSL certificate as well,
but it sounds like overkill in this case.

Brad
www.bvstools.com

On Wed, Jan 11, 2017 at 3:17 AM, Alasdair Simpson <
Alasdair.Simpson@xxxxxxxxxxxxxxx> wrote:

> Hi
>
> We have a specific application which creates HTML to send to a Wintel
> server and get a response back. We would like to secure this by SSL.
> All the documentation I have read so far says that to secure a specific
> application, you have to use the Digital Certificate Manager (DCM) to
> declare the application and then use a Client/Server certificate to secure
> it.
> While testing, I have been able to use the DCM to generate a new
> client/server certificate but there does not seem to be any way to export
> this in a form that the target Wintel server can understand. It only seems
> to allow you to send it to another iSeries.
>
> Going from the other side, the various Java Key tools I have found will
> create a full Organization certificate but are unaware of this
> 'client/server' level. Thus we don't seem to be able to create the require
> certificate level on the Windows server either.
>
> Do we need to go out to an Internet provider and request certificates from
> them? If so, how we ask for the iSeries side and Windows side and get them
> to use the same keys?
>
> Any help or pointer much appreciated.
>
>
> Alasdair Simpson
>
>
> Target Group Registered in England & Wales No 01208137. Registered Office:
> Target House, Cowbridge Road East, Cardiff CF11 9AU.
>
> CONFIDENTIALITY. This email and any attachments are confidential and may
> also be privileged. If you are not the intended recipient, please do not
> disclose the contents to anyone, or take any action based on them, but
> notify the sender by return email and delete this email (and any
> attachments) from your system.
>
> Messages sent to and from us may be monitored.
>
> Internet communications cannot be guaranteed to be secure or error-free.
> This e-mail and any attachments have been checked by virus detection
> software before transmission. You should carry out your own virus checks on
> the contents of this communication. We accept no liability for any loss or
> damage which may be caused by software viruses or by interception or
> interruption of this mail.
>
> Any views or opinions presented are solely those of the author and do not
> necessarily represent those of the company. We do not accept any liability
> arising in any way from relying upon such views or opinions.
>
> Calls may be recorded for training and security purposes.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD