Re: TLS/SSL Certificate update for IBM i ODBC

Yes. AFAIK, you have to intsall the cert on every ODBC client whenever the
cert changes. Why does ODBC require it, when 5250 and Apache don't?
That's a good question, and I'd love to know the answer.



date: Fri, 1 Mar 2024 14:50:22 +0000

from: "Sizer, Joseph via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
subject: TLS/SSL Certificate update for IBM i ODBC

Each year I use Digital Certificate Manager (DCM) to import my new SSL
cert. My root and CA cert are still good. I then assign the new SSL cert
to the applications that require them based on what last year's cert was
assigned to. I then verify that telnet, IBM i HTTP servers, etc. are all
using the new SSL cert.

This year, a client PC that uses a System DSN 64-bit ODBC connection to
the IBM I for a Microsoft Word mail merge, generated an error that defined
the SSL cert as not being trusted. I am using ODBC driver IBM I Access
ODBC Driver version 13.64.27.00 and ACS version 1.1.9.4.

The error message generated when testing the connection is:
Data link error: Test connection failed because of an error in
initializing provider. IBM System I Access ODBC Driver Communication link
failure. Comm rc-25414 - CWBCO1050 - The IBM I server application
certificate is not trusted.

Changing the ODBC driver configuration to Non-SSL allows the mail merge to
work (Configure / Connection Options / Security - Do not user Secured
Sockets Layer (SSL)

Telnet (ACS) does not require any update at the PC client level. Is
anyone aware of a requirement where a PC client ODBC connect must run an
update for a new SSL cert? I would like to switch the connection back to
SSL.

Thanks.


Joe Sizer
IBM I Power Systems Administrator
Pencor Digital Services