Securing an Endpoint Connection

Overview

To use TLS security to encrypt an IBM i Connection for Powertech Compliance Monitor for IBM i, you must create and configure a Digital Certificate (also called a Certificate Authority) on the Endpoint. To do so requires the following steps:

On the Consolidator and each Endpoint

  • Create a Certificate. Use IBM's Digital Certificate Manager to create the Certificate.
  • Export the Certificate. Export the Certificate from the Digital Certificate Manager.

On the Consolidator

  • Import the Certificate. Import the Certificate into your Java Runtime Environment.
  1. Open the Digital Certificate Manager by going to http://your server name:2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0.
    2. EXAMPLE:
    http://your server name:2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0
    NOTE: To open this URL, the http server must be running on your IBM i system. To start the http server, use the following command:
    STRTCPSVR SERVER(*HTTP) HTTPSVR(*admin)
  2. Click Create a Certificate Authority (CA) on the left side menu. After you use this task to create a private local CA, this task no longer appears in the list.
  3. Enter the requested information and click Continue.
  4. For 'Install Local CA Certificate,' review the text and click Continue.
  5. For 'Certificate Authority (CA) Policy Data,' verify information and click Continue.
  6. On the 'Policy Data Accepted' screen, click Continue again.
  7. On the Create a Server or Client Certificate screen, you are prompted to create the Certificate store *SYSTEM. Enter the requested information and click Continue.
  8. Select applications that should trust the Certificate Authority and click Continue.

    Be sure to include these Applications

    • Database Server
    • Data Queue Server
    • Remote Command Server
    • Signon Server
    • File Server

  9. Continue to create an Object Signing Certificate, if desired (not required) or click Cancel.
  1. Open the Digital Certificate Manager by going to http://your server name:2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0.
  2. Click Select a Certificate Store.
  3. Select *SYSTEM and click Continue.
  4. . Enter the Certificate store password and click Continue.
  5. Select Manage Certificate on the left, and then Export Certificate and click Continue.
  6. Select Certificate Authority, then click Continue.
  7. Select the Certificate Authority you created and click Export.
  8. Select File and click Continue.
  9. Enter a file path for the IBM i IFS and click Continue.

    10. EXAMPLE: 
    /tmp/certServer.arm

  10. You can now exit out of the Digital Certificate Manger.
  11. Send the exported file from the Endpoint system to the Consolidator system (e.g. via FTP).
    1. On the Endpoint system, at a command line start an FTP connection to the Consolidator system.
    2. Enter credentials to login if prompted.
    3. Once logged in, enter quote site namefmt 1.
    4. To copy the file, enter PUT /path/to/file/system.arm /path/to/file/system. arm

      5. EXAMPLE: 
      put /tmp/certServer.arm  /tmp/certServer.arm

  1. Find out which Java version you are using for Powertech Compliance Monitor for IBM i.

    On the Consolidator system enter the command ptcmt2/lprdvrm

  2. On the Consolidator system, locate the directory that corresponded to your Java Version. Typically it is located in /QOpenSys/QIBM/ProdData/JavaVM/your Java Version/32bit.
    EXAMPLE:
    Example for Java Version 1.70
    /QOpenSys/QIBM/ProdData/JavaVM/jdk70/32bit
  3. Add the exported certificate authority to the Java keystore. For this example, the keystore will be added to the JVM under /QOpenSys/QIBM/ProdData/JavaVM/jdk70/32bit. To add the keystore to a different JVM, change the path name as appropriate.

    Run the following steps from the QSH command line:

    1. Convert the exported Certificate Authority (certServer.arm) to CCSID 819:

      2. touch -C 819 /tmp/certServer819.arm; cat /tmp/certServer.arm > /tmp/certServer819.arm

    2. Add the Certificate Authority to the keystore using the converted Certificate Authority.

      3. keytool -importcert –keystore /QOpenSys/QIBM/ProdData/JavaVM/jdk70/32bit/jre/lib/security/cacerts -file /tmp/certServer819.arm -storepass thePw

      NOTE: The default password for the storepass parameter is “changeit”. The storepass parameter isn’t the same as the password to DCM.

      Enter yes when asked to “trust this certificate.”

    3. Optional - You may want to create a permanent directory to store the cacerts file. This can be anywhere on the system. Copying the modified cacerts file to a different directory (instead of using the default) ensures the file won’t be overwritten in the event Java PTFs are installed on the system.
      4. mkdir /QOpenSys/QIBM/UserData/jdk70

      Copy the changed cacerts file to the new directory created in the previous step.

      cp
/QOpenSys/QIBM/ProdData/JavaVM/jdk70/32bit/jre/lib/security/cacerts/QOpenSys/QIBM/UserData/jdk70
  4. Type yes and press Enter.
  5. Restart the Consolidator
NOTE: For more information regarding the IBM Digital Certificate Manager, see Digital Certificate Manager (DCM) - Frequently Asked Questions and Common Tasks.