Re: V7R3 DCM Certicate Authority root and intermediate updates

It is a very simple procedure to install the root cert, easier than
applying a PTF.  I do not think it is a good idea to install
automatically all the cert, rather install only the ones I need.

It will be a good idea to delete the old one (probably VeriSign)


On 03/19/2018 10:34 AM, Steinmetz, Paul wrote:

We had a 3rd party application update their SSL wildcard cert this past Saturday.
Our application failed with below errors.

SSL_Handshake() error [IBM -23]: Certificate is not signed by a trusted certificate authority.
Error 51: SSL peer certificate or SSH remote key was not OK
Closing connection #0
SSL peer certificate or SSH remote key was not OK

Their new cert required us to have the below root and intermediate CA added to our system store.

DigiCertGlobalRootCA.crt
DigiCertSHA2SecureServerCA.crt

The folks that maintain SSL for our Windows and Linux servers stated these CA updates are automatic and included with their OS updates.

My doesn't IBM do the same for i?
Have new and updated CAs applied to system store via PTFs.

Or are there any processes/procedures to be more proactive for future SSL updates?

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/

-- Este e-mail fue enviado desde el Mail Server del diario ABC Color --
-- Verificado por Anti-Virus Corporativo Symantec --