Securing an IBM i Product Connection

In order to use TLS security to encrypt an IBM i Product Connection from Insite, you must create and configure a Digital Certificate (also called a Certificate Authority). To do so requires the following steps:

  • Create a Certificate. Use IBM's Digital Certificate Manager to create the Certificate.
  • Export the Certificate. Export the Certificate from the Digital Certificate Manager.
  • Import the Certificate. Import the Certificate into your Java Runtime Environment.
  1. Open the Digital Certificate Manager by going to http://your server name:2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0.

    EXAMPLE:
    http://myservername:2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0

    NOTE:
    To open this URL, the http server must be running on your IBM i system. To start the http server, use the following command:

    STRTCPSVR SERVER(*HTTP) HTTPSVR(*admin)

  2. Click Create a Certificate Authority (CA) on the left side menu.
  3. Enter the requested information and click Continue.
  4. For 'Install Local CA Certificate,' review the text and click Continue.
  5. For 'Certificate Authority (CA) Policy Data,' verify information and click Continue.
  6. On the 'Policy Data Accepted' screen, click Continue again.
  7. On the Create a Server or Client Certificate screen, you are prompted to create the Certificate store *SYSTEM. Enter the requested information and click Continue.
  8. Select applications that should trust the Certificate Authority and click Continue.
  9. Continue to create an Object Signing Certificate if desired (not required).
  1. Open the Digital Certificate Manager by going to http://your server name:2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0.
  2. Click Select Certificate Store.
  3. Select *SYSTEM and click Continue.
  4. Enter the Certificate store password and click Continue.
  5. Select Manage Certificate on the left, and then Export Certificate.
  6. Select Certificate Authority, then click Continue.
  7. Select the Certificate Authority you created and click Export.
  8. Select File and click Continue.
  9. Enter a file path for the IBM i IFS and click Continue.
  10. Download the file from the IBM i onto the system running Insite (e.g. via FTP).

    1. Using a command prompt, open an FTP connection to the IBM i system using ‘ftp systemname’ (cmd (Windows) or bash/shell (Linux)).

    2. Enter credentials to login if prompted.

    3. Once logged in, enter quote site namefmt 1.

    4. To copy the file, enter GET /path/to/file/system.crt. The file will be copied to the folder you are in within the command prompt.

  1. Open a command prompt in java 'bin' folder.
    cd "c:\Program Files (x86)\Help Systems\HelpSystems Insite\jvm\bin"
  2. Run 
    keytool -import -alias Server Alias -file Certificate Path -keystore Keystore Path
    EXAMPLE:
    keytool -import -alias HS55 -file c:\helpsys\insitecert_HS55 -keystore "C:\Program Files (x86)\Help Systems\HelpSystems Insite\jvm\lib\security\cacerts"
  3. Enter the keystore password, "changeit" by default.
  4. Type yes and press Enter.
  5. Restart the Insite server

After completing these steps, see Adding a New Product Connection in order to add a new connection in Insite.

NOTE: For more information regarding the IBM Digital Certificate Manager, see Digital Certificate Manager (DCM) - Frequently Asked Questions and Common Tasks.

 

Related Topics