RE: Question on allocating Storage

[Scott Klement <klemscot@xxxxxxxxxxxx>]

> It appears that using the iSeries as a client for negotiating both the
> SSL session and the authentication is a little different than when a PC
> performs the same. The PC normally has a root cert used to negotiate the
> SSL session. Where the server requires Basic Authentication then that is
> sufficient. Where The PC normally has a root cert used to negotiate the
> SSL session.

The PC and the iSeries are exactly the same.  You're confusing the act of
validating the server's certificate with the act of sending your own
client certificate -- two very different things.  Sending the client
certificate is an optional bit which isn't done when talking to public web
servers because the server doesn't need to trust the client.  However,
in private business dealings it's very common for both sides to have to
authenticate each other.

Basic Authentication has nothing whatsoever to do with SSL.  It's part of
HTTP, and can be used with or without SSL being involved, and with or
without client authentication involved.


> Where the server requires a digital cert for authentication then it is
> necessary to import a totally separate cert ( possibly from a totally
> separate CA) into the PC in order to implement this.
>
> However, the iSeries appears to make no such distinction for the similar
> senario. It provides only for assigning a single cert to an application
> via the DCM, which you are undoubtedly aware of since I know you have
> already written such software.

Not true.  The iSeries definitely does make a distinction! When you click
on "Manage trusted roots" (or some similar name) you're telling the DCM which
server certificates your client trusts.  When you're setting up a client
application and assigning a certificate to it, you're assigning a client
cert that it sent when client authentication is enabled.

You may be confused by the fact that in pre-V5R1 versions of OS/400, it
was not possible to set up a secure application without assigning a client
certificate.  That was an oversight which IBM corrected.

However, you still had separate "trusted root" vs. "application
certificate" settings.  The system has always distinguished between them.