Configuring TLS Support with certificate authentication in a non-Java Db2 client

You can configure Db2 database clients, such as CLI, CLP, and .Net Data Provider clients, to support Transport Layer Security (TLS) with certificate authentication. You use certificate authentication to establish a TLS connection with a Db2 for z/OS server.

1. On a computer where gsk8capicmd_64 is available, create a keystore from the server certificate.
   This can be done on the server computer, or a client computer where GSKit has been installed separately from the client. For more information, see Introduction to Global Security Kit installation.

   gsk8capicmd_64 -keydb -create -db "client.p12" -pw "myClientPassw0rdpw0" -stash 

   where -stash creates a stash file at the same path as the key database, with a file extension of .sth. At connect time, GSKit uses the stash file to obtain the password to the key database.
2. Add the server certificate to the client keystore.
   If the server certificate is self-signed, ask your administrator to extract the certificate from the server into an ascii formatted file. If the server certificate is signed by a third party CA, obtain the CA's root certificate. This can be done by asking the CA, and is usually provided when signing the server certificate.

   Note: The root certificate must be used on the client when configuring TLS support for a CA-signed server certificate.

   gsk8capicmd_64 -cert -add -db "client.p12" -stashed -label "myServerCert" -file "server.pem" -format ascii

3. Configure an authentication certificate.
   To successfully configure certificate authentication, the client keystore must contain a certificate and private key that identifies the client. The procedure is similar to creating a certificate in a Db2 server.
   To create an authentication certificate that is self-signed, see Creating a self-signed certificate with GSKit. To create an authentication certificate that is signed by a 3rd party, a CSR must be created in the client's keystore, root and intermediate certificates must be added to the keystore, and the server certificate must be received.

   Note: For information on how to use an authentication certificate where both the certificate and private key have been provided by a 3rd party, see Adding a certificate chain.
4. When the authentication certificate has been created, extract the certificate to a Base64-encoded certificate file and send it to your system administrator for configuration in the Db2 server.
   Replace -label clientCert with the label of the authentication certificate.

   gsk8capicmd_64 -cert -extract -db client.p12 -stashed -label clientCert -target clientCert.crt -format ascii

   Note: Always use the -extract option for moving certificates to a certificate file for nodes in your network, and not the -export option. Using the -export option moves the private key from your keystore into the certificate file, making it visible to your network.
5. Save the extracted certificate in a convenient location and send it to your system administrator.
6. Copy the key database and stash file to the client computer.
   Ensure that the client has the proper file permissions to read both the key database and the stash file. To configure your client application, set the appropriate connection string or configuration parameters, as shown in the applicable example for your client.

"Database=sampledb; Protocol=tcpip; Hostname= myhost; Servicename=50001; 
Security=ssl; SSLClientKeystoredb=/home/db2inst1/client.p12;
SSLClientKeystash=/home/db2inst1/client.sth;Authentication=CERTIFICATE;SSLClientLabel=clientCert;"

[sampledb]
Database=sampledb
Protocol=tcpip
Hostname=myhost
Servicename=50001
Security=ssl
SSLClientKeystoredb=/home/db2inst1/client.p12
SSLClientKeystash=/home/db2inst1/client.sth
Authentication=CERTIFICATE
SSLClientLabel=clientCert

[ODBC]
DRIVER=IBM DB2 ODBC DRIVER – DB2COPY1
UID=user1
AUTHENTICATION=SERVER
PORT=50001
HOSTNAME=myhost
PROTOCOL=TCPIP
DATABASE=SAMPLEDB
SECURITY=SSL
SSLClientKeystoredb=/home/db2inst1/client.p12
SSLClientKeystash=/home/db2inst1/client.sth
Authentication=CERTIFICATE
SSLClientLabel=clientCert

<dsn alias="sample" host="myhost.ibm.com" name="sample" port="50001">
   <parameter name="SSLClientKeystoredb" value="/home/db2inst1/client.p12"/>
   <parameter name="SSLClientKeystash" value="/home/db2inst1/client.sth">
   <parameter name="SecurityTransportMode" value="SSL"/>
   <parameter name="Authentication" value="CERTIFICATE"/>
   <parameter name="SSLClientLabel" value="clientCert"/>
</dsn>