Hi Paul
Same issue here two weeks ago for two critical applications. This caused
several hours of downtime
for the applications by the time we diagnose the issue.
As we have no control when customers and or partners update or change the
CA that signed their cert.
I think it would be a great idea to have well know CA's automatically
added by IBM.
Jim
Jim W Grant
Senior VP, Chief Information Officer
Web: www.pdpgroupinc.com
From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 03/19/2018 09:35 AM
Subject: V7R3 DCM Certicate Authority root and intermediate updates
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
We had a 3rd party application update their SSL wildcard cert this past
Saturday.
Our application failed with below errors.
SSL_Handshake() error [IBM -23]: Certificate is not signed by a trusted
certificate authority.
Error 51: SSL peer certificate or SSH remote key was not OK
Closing connection #0
SSL peer certificate or SSH remote key was not OK
Their new cert required us to have the below root and intermediate CA
added to our system store.
DigiCertGlobalRootCA.crt
DigiCertSHA2SecureServerCA.crt
The folks that maintain SSL for our Windows and Linux servers stated these
CA updates are automatic and included with their OS updates.
My doesn't IBM do the same for i?
Have new and updated CAs applied to system store via PTFs.
Or are there any processes/procedures to be more proactive for future SSL
updates?
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx<mailto:psteinmetz@xxxxxxxxxx>
http://www.pencor.com/
midrange.com
