Db2 SSL connection for WebSphere Application Server

IBM Content Navigator supports connections to a DB2® database by using Secure Sockets Layer (SSL) encryption on WebSphere® Application Server. SSL connections provide enhanced security for data transmission between the application server and the database.

Prerequisites

Before you configure Db2 SSL connections, ensure that you complete the following tasks:

Created a Db2 database for IBM Content Navigator. For more information, see Preparing your web application server for IBM Content Navigator components.
Configured SSL on the Db2 server. For more information, see the Db2 documentation for configuring SSL/TLS.
Obtained the Db2 server SSL certificate from your database administrator.
Installed the Db2 JDBC driver that supports SSL connections (Db2 Universal JDBC Driver Type 4) on the IBM Content Navigator server. The driver files are typically named db2jcc4.jar and db2jcc_license_cu.jar.
Gathered the required SSL configuration parameters. For more information, see Worksheet for creating a data source and updating the database script for your Db2 or Db2 SSL database.

About Db2 SSL connections

SSL encryption for Db2 connections provides the following benefits:

Data encryption: All data that is transmitted between the application server and the database is encrypted, protecting sensitive information from unauthorized access.
Server authentication: SSL certificates verify the identity of the database server, preventing man-in-the-middle attacks.
Compliance: SSL encryption helps meet security and compliance requirements for data protection.

Important: SSL configuration requires coordination with your database administrator to ensure that the Db2 server is properly configured for SSL connections and that you have the correct certificates.

Db2 with SSL encryption is supported for both IBM Content Navigator databases and Content Platform Engine global configuration database (GCD) and object store databases.

Configuration requirements

To configure a Db2 SSL connection for IBM Content Navigator, you need the following information:

SSL certificates

The Db2 server SSL certificate must be imported into the WebSphere Application Server truststore. Work with your database administrator to obtain the certificate file in PEM or DER format.

JDBC driver files

The Db2 Universal JDBC Driver (Type 4) JAR files: db2jcc4.jar and db2jcc_license_cu.jar. These files must be accessible to the application server.

Connection parameters

Database hostname or IP address
SSL port number (typically different from the standard port 50000)
Database name
Database username and password
SSL-specific properties: sslConnection=true

Connection URL format

When SSL is enabled, the Db2 connection URL uses the following format:

jdbc:db2://hostname:ssl_port/database_name:sslConnection=true;sslTrustStoreType=<trustStoreType>;sslTrustStoreLocation=<trustStorePath>;sslTrustStorePassword=<trustStorePassword>;

For example:

jdbc:db2://dbserver.example.com:50001/ICNDB:sslConnection=true;sslTrustStoreType=jks;sslTrustStoreLocation=<path>/security.jks;sslTrustStorePassword=password;

Configuring the connection

Use the IBM Content Navigator Configuration and Deployment Tool to configure the Db2 SSL connection. The tool creates the JDBC provider and data source with the appropriate SSL settings.

For information about the parameters required by the Configuration and Deployment Tool, see the worksheet for your database configuration.

Tip: If you imported the Db2 certificate into the WebSphere truststore, you may not need to specify additional truststore location and password parameters in the data source custom properties.

Verification

After you configure the Db2 SSL connection, IBM Content Navigator can connect to the Db2 database by using encrypted SSL connections, providing enhanced security for data transmission.

To verify the SSL connection:

Test the data source connection in the WebSphere Application Server administrative console.
Check the WebSphere and Db2 server logs for any SSL-related errors.
Verify that the sslConnection property is set to true in the data source configuration.

Post-configuration tasks

After you configure the Db2 SSL connection, complete the following tasks:

Run the database configuration script to create the IBM Content Navigator tables. For more information, see Running the script to configure your database for IBM Content Navigator.
Restart the WebSphere Application Server server.
Verify that IBM Content Navigator can connect to the database by logging in to the administration console.
Monitor the connection to ensure that SSL encryption is working correctly.

Tip: For more information about configuring SSL for Db2, see the Db2 documentation for your version.