Thank you to everyone that assisted with this issue.
After a few more days of testing, I believe I have gotten to a good solution.
While the recommendation provided by Richard Schoen initially worked, the next day it stopped working. I kept trying different methods to get a consistent solution. I did use this link, which was in Richard's document -
https://www.ibm.com/support/pages/importing-certificates-use-ibm-i-access-client-solutions-windows-application-package-acs-winap
I was using the "Push to Windows" method that is in IBM i Access Client Solutions (Tools / Key Management) as it saved me the step of having to manually validate my certs using gsk8capicmd.exe (gsk8capicmd.exe -cert -modify -trust enable). Using the Push to Windows method added the information to the key database file located in C:\Users\Public\Documents\IBM\Client Access\cwbssldf.kdb and marked it as trusted for me.
Two additional items made a difference. Since I was using Microsoft Word Mail Merge, if the ODBC connection failed, updating the key management database was not enough. MS Word was caching the cert info. I had to close all other Word/Excel documents and then retry the ODBC connection. Second, I found out that my AD environment had an Active Directory Group Policy that would automatically push the key database file cwbssldf.kbd to all PCs. So, each time I fixed the file, it would get replaced again at the next push. Now the Group Policy has the correct file and the ODBC connection is working.
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Richard Schoen
Sent: Friday, March 1, 2024 10:20 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: Re: TLS/SSL Certificate update for IBM i ODBC
________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
________________________________
Check this link out. I have run into this issue before.
https://github.com/richardschoen/howtostuff/blob/master/ibmi_acs_odbcssl_windows_issue_.md
Regards,
Richard Schoen
Web:
http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx
-----Original Message-----
On Fri, Mar 1, 2024 at 8:50?AM Sizer, Joseph via MIDRANGE-L < midrange-l@xxxxxxxxxxxxxxxxxx> wrote:
Each year I use Digital Certificate Manager (DCM) to import my new SSL
cert. My root and CA cert are still good. I then assign the new SSL
cert to the applications that require them based on what last year's
cert was assigned to. I then verify that telnet, IBM i HTTP servers,
etc. are all using the new SSL cert.
This year, a client PC that uses a System DSN 64-bit ODBC connection
to the IBM I for a Microsoft Word mail merge, generated an error that
defined the SSL cert as not being trusted. I am using ODBC driver IBM
I Access ODBC Driver version 13.64.27.00 and ACS version 1.1.9.4.
The error message generated when testing the connection is:
Data link error: Test connection failed because of an error in
initializing provider. IBM System I Access ODBC Driver Communication
link failure. Comm rc-25414 - CWBCO1050 - The IBM I server
application certificate is not trusted.
Changing the ODBC driver configuration to Non-SSL allows the mail
merge to work (Configure / Connection Options / Security - Do not user
Secured Sockets Layer (SSL)
Telnet (ACS) does not require any update at the PC client level. Is
anyone aware of a requirement where a PC client ODBC connect must run
an update for a new SSL cert? I would like to switch the connection
back to SSL.
Thanks.
Joe Sizer
IBM I Power Systems Administrator
Pencor Digital Services
--
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
midrange.com
