Re: Assorted questions and musings, Re: So has anybody come up with a solution for certificate automation that will work on a Midrange box?

There could be many things at play here.
One, most browsers insist on using https vs http. (Google hsts).
Another is many browsers absolutely will not connect to self signed certs
and if you do not have the right certs applied to Navigator it can be a
challenge.
If you do have the right certs, and they are for something like a wildcard
(*.myco.com) or a single site (like myibmi.myco.com) you have better by
golly put that .myco.com in your url or the browser may not like the cert
either.
Certain PTF levels changed Navigator to shutdown some of the http ports and
require the https ports.

There is documentation on Navigator and the ports used.
https://www.ibm.com/docs/en/i/7.5.0?topic=system-navigator-i
https://www.ibm.com/support/pages/ibm-navigator-i

7.5 with current PTF's and this works for me as a starting point
https://sgctlkit.dekko.com:2003/Navigator/login

Once you get the above to work you can go into bookmarks to edit the
following. I think the following is generally followed with some debate as
to whether or not you should completely shutdown the non TLS ports. In the
GUI there are wizards to help with all of this.

Name, URL, TLS Port, Non TLS Port, HTTPs
(You figure out where the commas go)
IPP Server for IBM i /IPPAdmin 2010 2001 Yes IPP Server for IBM i
sgctlkit.dekko.com YES
IBM Web Administration for i /HTTPAdmin 2010 2001 Yes IBM Web
Administration for i sgctlkit.dekko.com YES
IBM Digital Certificate Manager for i /dcm 2007 2006 Yes IBM Digital
Certificate Manager for i sgctlkit.dekko.com YES
Cryptographic Coprocessor Configuration /QIBM/CCA/Admin/qc6fmenu.ndm/main0
2010 2001 Yes Cryptographic Coprocessor Configuration sgctlkit.dekko.com NO
IBM PowerHA for i 2098 No IBM PowerHA for i sgctlkit.dekko.com YES
IBM Tivoli Directory Server for IBM i - LDAP /IDSWebApp/IDSjsp/Login.jsp
2005 2004 Yes Lightweight Directory Access Protocol (LDAP) or Directory
Server sgctlkit.dekko.com YES
Memo to Users /docs/en/i/7.5?topic=users-whats-new Yes IBM i Documentation:
What's new in Memo to Users www.ibm.com YES
IBM BRMS for i 2089 2088 Yes IBM Backup, Recovery & Media Services (BRMS)
for i sgctlkit.dekko.com YES
IBM Db2 Mirror for i /Db2Mirror 2007 2006 Yes IBM Db2 Mirror for i
sgctlkit.dekko.com NO
Application Runtime Expert (heritage) /are 12402 12401 Yes Application
Runtime Expert (heritage) sgctlkit.dekko.com YES
Deprecated Cryptographic Coprocessor GUI /QIBM/CCA/Admin/qc6fmenu.ndm/main0
2010 2001 Yes

On Mon, Apr 6, 2026 at 11:51 AM James H. H. Lampert via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

On 4/3/26 12:25 PM, Tim Rowe wrote:

The Navigator team has been working to help this situation. Within
Navigator, under the Network -> Servers -> TLS Configuration

Interesting. But we're not a Navigator shop. I followed the link at the
end of Mr. Rowe's posting, and tried accessing our cloud V7R5 box.
Results were not encouraging. The article listed unsecured on ports 2002
and 2001, and secured on 2003 and 2010.

2003 failed immediately. When I opened a terminal session and did a
WRKTCPSTS, I found out it wasn't listening. 2010 just sat there until it
timed out, but at least the WRKTCPSTS showed traffic. Ditto for the
unsecured ports. I then noticed the part about hostname:xxxx/Navigator,
and tried that, on all the ports that were actually listening. The only
one where I even got a sign-on screen was unsecured 2002, and when I
tried to sign on, I got "NAV_300013: Connection to node that the GUI is
running on is not available or host servers cannot be connected. Fix the
network problem and retry."

I'm not averse to learning at least the rudiments of Navigator (although
an entirely terminal-based solution would almost certainly be better for
our purposes, given that it could then be put into a CL program, and
besides, I can't imagine too many of our customers giving us Navigator
access to their boxes), but at this point, I'm facing a brick wall,
without any clue about where exactly the brick wall is.

--
JHHL
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.