Configuring TLS support in non-Java Db2 clients

catalog TCPIP NODE mynode  REMOTE  127.0.0.1  SERVER 50001  SECURITY SSL 

catalog DATABASE sample  AS myssldb  AT NODE mynode  AUTHENTICATION SERVER

Next, use the ssl_clnt_keydb and ssl_clnt_stash configuration parameters to specify the client key-database and the stash file. You set the ssl_clnt_keydb configuration parameter to the fully qualified path of the key database file (.kdb) and the ssl_clnt_stash configuration parameter to the fully qualified path of the stash file:

db2 update dbm cfg using 
      SSL_CLNT_KEYDB /home/test1/sqllib/security/keystore/clientkey.kdb 
      SSL_CLNT_STASH /home/test1/sqllib/security/keystore/clientstore.sth

Then, connect to the server from the CLP client:

db2 connect to myssldb user user1 using password

Strcpy(dbAlias,"myssldb");
 EXEC SQL CONNECT TO :dbAlias USER :user USING :pswd;

Depending in which environment you are running your CLI application, you use either connection string parameters (SSLClientKeystoredb and SSLClientKeystash) or Db2 configuration parameters (ssl_clnt_keydb and ssl_clnt_stash) to specify the path for the client key database and for the stash file.

• If you are using the IBM Data Server Driver for ODBC and CLI, you use connection string parameters, as shown in this example:
  Call SQLDriverConnect with a connection string that contains the SECURITY=SSL keyword. For example:

  "Database=sampledb; Protocol=tcpip; Hostname= myhost; Servicename=50001; 
  Security=ssl; SSLClientKeystoredb=/home/test1/keystore/clientstore.kdb;
  SSLClientKeystash=/home/test1/keystore/clientstore.sth;"

  In this case, because Security=ssl is specified, the SSLClientKeystoredb and SSLClientKeystash connection string parameters must be set, otherwise the connection will fail.

• If you are using the IBM data server client or IBM Data Server Runtime Client, you can use either connection string parameters or Db2 configuration parameters to set the path for the client key database and for the stash file. If the SSLClientKeystoredb and SSLClientKeystash connection string parameters are set, they override any values set by the ssl_clnt_keydb or the ssl_clnt_stash configuration parameters.
  This example uses the db2cli.ini file to set connection string parameters:

  [sampledb]
  Database=sampledb
  Protocol=tcpip
  Hostname=myhost
  Servicename=50001
  Security=ssl
  SSLClientKeystoredb=/home/test1/keystore/clientstore.kdb
  SSLClientKeystash=/home/test1/keystore/clientstore.sth
  

  This example uses the FileDSN CLI/ODBC keyword to identify a DSN file that contains the database connectivity information, which sets the connection string parameters. For example, the DSN file may look like this:

  [ODBC]
  DRIVER=IBM DB2 ODBC DRIVER – DB2COPY1
  UID=user1
  AUTHENTICATION=SERVER
  PORT=50001
  HOSTNAME=myhost
  PROTOCOL=TCPIP
  DATABASE=SAMPLEDB
  SECURITY=SSL
  SSLClientKeystoredb=/home/test1/keystore/clientstore.kdb
  SSLClientKeystash=/home/test1/keystore/clientstore.sth
  

  In these cases, because Security=ssl is specified, if the SSLClientKeystoredb and SSLClientKeystash connection string parameters are not set, and also the ssl_clnt_keydb and ssl_clnt_stash configuration parameters are not set, the connection will fail.

From Db2 V10.5 FP5 onwards, the SSLClientKeystoredb and SSLClientKeystash keywords are not needed in the connection string, db2cli.ini file, FileDSN, or db2dsdriver.cfg file. If you have not set or passed values for the SSLClientKeystoreddb and SSLClientKeystash keywords, the CLI/ODBC client driver will create a default key database internally during the first SSL connection. The Client driver will call GSKit API's to create a key database populated with the default root certificates. If the application has passed the signer certificate of the server (*.arm file)using the SSLServerCertificate keyword, the client driver will add this certificate to this default key database and proceed for the SSL connection. In this case, the application needs to use the Security=SSL and SSLServerCertificate=<certificate file name> as in below connection string.

 "Database=sampledb;Protocol=tcpip;Hostname=myhost;Servicename=50001;Security=ssl;SSLServerCertificate=server.arm;"

An example of the IBM data server driver configuration file (db2dsdriver.cfg) entry follows:

<parameter name="Authentication" value="CERTIFICATE"/>

A Db2 .Net Data Provider application can establish an SSL connection to a database by specifying the path for the client key database and for the stash file by defining the connection string parameters, SSLClientKeystoredb and SSLClientKeystash. The connection string must also contain Security=SSL. For example:

String connectString = "Server=myhost:50001;Database=sampledb;Security=ssl;
SSLClientKeystoredb=/home/test1/keystore/clientstore.kdb;
SSLClientKeystash=/home/test1/keystore/clientstore.sth";

Then, as shown in the following C# code fragment, to connect to a database, pass this connectString to the DB2Connection constructor and use the Open method of the DB2Connection object to connect to the database identified in connectString:

DB2Connection conn = new DB2Connection(connectString);
Conn.Open();
Return conn;

From Db2 V10.5FP5 onwards, you do not need to use the SSLClientKeystoredb and SSLClientKeystash keywords in the SSL connection. However, the connection string must also contain Security=SSL. The connection string can be used as below:

 String connectString = "Server=myhost:50001;Database=sampledb;Security=ssl;SSLServerCertificate=server.arm;";