Re: Use of HTTP_POST resulting in GSKit Error is 6000 - Certificate is not signed by a trusted certificate authority.

https://imgur.com/pUJCt8j


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Brad Stone
Sent: Thursday, April 14, 2022 11:42 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Use of HTTP_POST resulting in GSKit Error is 6000 -
Certificate is not signed by a trusted certificate authority.

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.


I didn't know it was there, honestly. I like it better already just for
the speed. How do you get to new DCM from the new nav, though?

I go to http://192.168.201.32:2002/Navigator/

I don't see options for DCM.

On Thu, Apr 14, 2022 at 10:24 AM Rob Berendt <rob@xxxxxxxxx> wrote:

There's a lot to like in the new navigator. If people just could get

more

acceptable of change.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Brad Stone
Sent: Thursday, April 14, 2022 11:21 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx

Subject: Re: Use of HTTP_POST resulting in GSKit Error is 6000 -
Certificate is not signed by a trusted certificate authority.

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.


I didn't find it much different than the old. :) open the certificate
store and import. I wonder if creating the *SYSTEM store is just as

easy..

most likely.

New one seems faster too.. doesn't appear to use Net.Data (or as well
called in back in the day, net.slow).

On Thu, Apr 14, 2022 at 10:11 AM Rob Berendt <rob@xxxxxxxxx> wrote:

Thanks. I just figured that out too. And that worked.
I do appreciate your help and also taking the time to work with the new
one. But, what the hey, sooner or later you'd have to learn it anyway,
right?

BTW, if you are using the New Navigator and you go into Bookmarks, IBM
Digital Certificate Manager for i, you're going to get the new DCM.

SQL runs like a champ.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Brad Stone
Sent: Thursday, April 14, 2022 10:57 AM
To: Midrange Systems Technical Discussion <

midrange-l@xxxxxxxxxxxxxxxxxx

Subject: Re: Use of HTTP_POST resulting in GSKit Error is 6000 -
Certificate is not signed by a trusted certificate authority.

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and

know

the content is safe.


PS... I just tried the new one. If you open the *SYSTEM store the

import

option is there.

On Thu, Apr 14, 2022 at 9:55 AM Brad Stone <bvstone@xxxxxxxxx> wrote:

You don't have access to the older DCM? I didn't know there was a

newer

one.

Make sure *ADMIN HTTP servers are running and go to:

http://xx.xx.xx.xx:2001/QIBM/ICSS/Cert/Admin/qycucm1.ndm/main0

Replace xx's with your IBM i IP

On Thu, Apr 14, 2022 at 9:53 AM Rob Berendt <rob@xxxxxxxxx> wrote:

I don't suppose you have this updated for the newer DCM? I have no
Import that I see. I see Upload and I see Install.

IBM Digital Certificate Manager for i
http://myibmi:2006/dcm/mainframe/home

I extracted the cert chains from the website.
I Uploaded them here but I don't know which animal I'm supposed to
sacrifice next.
My run sql scripts is still getting the same error.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf

Of

Brad Stone
Sent: Thursday, April 14, 2022 9:13 AM
To: Midrange Systems Technical Discussion <

midrange-l@xxxxxxxxxxxxxxxxxx>

Subject: Re: Use of HTTP_POST resulting in GSKit Error is 6000 -
Certificate is not signed by a trusted certificate authority.

CAUTION: This email originated from outside of the organization. Do

not

click links or open attachments unless you recognize the sender and

know

the content is safe.


you need to export the CA chain and import them in to DCM. Here's a

link

to some docs that have steps:

https://docs.bvstools.com/home/ssl-documentation.

This is a case where if you used HTTPAPI or GETURI you'd have the

option

to
NOT import the CAs as they both have methods to bypass "not trusted"
errors.

On Thu, Apr 14, 2022 at 7:08 AM Rob Berendt <rob@xxxxxxxxx> wrote:

I am trying an example I saw in a Tim Rowe & Scott Forstie example

to

send

a text message from IBM i using SQL. Basically it goes like this:
values QSYS2.HTTP_POST(
'https://api.twilio.com/2010-04-01/Accounts/AC

<redacted>/Messages.json',

cast(
'&To=+12605551212' concat
'&From=+12675551212' concat
'&Body=Sample Text ' as varchar(855)),
'{"basicAuth":"AC<redacted>,<redacted>",
"header":"content-type,application/x-www-form-urlencoded"}');

However I am getting
SQL State: 38501
Vendor Code: -443
Message: [SQL0443] AXISC ERROR : HTTPTransportException: Cannot
initialize a channel to the remote end.
Failed to establish SSL connection to server, the operation
gsk_secure_soc_init() failed.
GSKit Error is 6000 - Certificate is not signed by a trusted

certificate

authority.

Coworker suggested this link:

https://www.ibm.com/docs/en/i/7.4?topic=programming-http-functions-overview

Basically it looks like either I figure out the certificate issues

and

put

them into DCM or run the script at this site and create a new

store

and

always specify this store when running any https type service .


I looked at twilio's site. I see this chain:
DigiCert
-DigiCert TLS RSA SHA256 2020 CA1
--*.twilio.com
Do I perform actions based on this chain? Or do I just do that

script

on

Knowledge Center?

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com