Re: SSL certificates for applications

[Bradley Stone <bvstone@xxxxxxxxx>]

Does your project REQUIRE a client side SSL certificate as well as a
service side certificate?

You most likely will, at the very least, have to import the CAs in the
chain from the Wintel server certificate.

Machine types don't matter.  IBM i, linux, wintel, etc... they all do SSL
the same.  The first step is to find out what you need for your project:

1.  Just a server side certificate (on the Wintel machine)

or

2.  A server side AND a client side certificate (I'm not referring to a CA
here, an actual client side certificate).  In this case, normally the
admins of the server create this client cert for you to import and assign
to your application so it's used in the communications.

I have an article about using client side certificates with our GETURI
software, but it also applies to any client doing sockets over SSL that
requires a client side cert:
http://www.fieldexit.com/forum/display?threadid=297

Brad
www.bvstools.com

On Wed, Jan 11, 2017 at 8:57 AM, Alasdair Simpson <
Alasdair.Simpson@xxxxxxxxxxxxxxx> wrote:

> Hi Bradley
>
> Thanks for that, but the problem is that if we import a CA certificate
> from Wintel into IBM i, it comes in as a CA certificate.
> IBM i will not allow you to attach a CA level certificate to an
> application, you have to create IBM's "Server or Client" level certificate.
> This is fine for communicating between  2 iSeries machines, but does not
> work in a mixed environment.
>
> IBM wants this special "Server or Client" level  certificate for itself
> which is incompatible with the Windows world which wants CA certificates.
> The DCM allows you to create your own "Server or Client" level
> certificate but it won't import into Windows.
> Windows lets you create a CA certificate, which can import onto the
> iSeries DCM but it then won't attach to an application.
>
> Alasdair