New IBM i DCM

Having wrestled with SSL problems (eventually diagnosed as an expired certificate) over the past few days I thought I'd just share a couple of discoveries with the folks on this list in case it helps someone else down the road.

1) Your main certificate can be just fine, but if somebody (Mentioning no names Comodo/Sectigo) has given you a secondary certificate in the bundle with the wrong expiry date ... Well everything will work until one day you restart your web server and the universe collapses. Note that in my case the faulty cert had expired over two weeks before the restart and the server was working just fine. The certificate in question is from USERTrust RSA Certification Authority and it expired on May 30th. Comodo/Sectigo have a replacement that you can download and install.

2) For diagnosing this kind of problem the regular DCM was about as much use as ... well it is not of much use unless you know what you are looking for. However, thanks to Steve Pitcher I was introduced to the shiny _new_ DCM which I had not even heard of. For those like me who are up to date on HTTP PTFs just add /dcm after the 2001: to get the new interface. It is magical _and_ had I known about the .... thing it would have saved me hours. Why? Because the expired certificate comes up in a glorious shade of pink and makes itself glaringly obvious!

Hope this saves someone some time. If nothing else check out the new dcm - it really is a huge improvement.


Jon Paris