Creating and using certificates for automation authentication

Edit online

About this task

In addition to Session Tokens and Personal Access Tokens, the IBM Copy Services Manager server supports the creation of client certificates for authenticating to the server.

Client certificates provide mutual TLS level authentication that uses x.509 certificates. These certificates provide a higher level of protection in communicating with server. Client certificates can be created through the IBM Copy Services Manager GUI and given a longer expiration so that automation can use them without requiring a user ID and password.

After you create the Client Certificate, you can use it in any REST call to the server that uses the "X-Client-Certificate" header until it expires or is revoked.

Procedure

  1. Login to the IBM Copy Services Manager GUI as the user that automation uses to issue calls to the server. All calls to the server that use the created certificate have the authority based on the user who created the certificate.
  2. In the upper right hand corner, hover over the username for the currently logged in user and in the pull down that pops up click Manage Authentication.
  3. Under the Certificate Authentication Management section, click the Manage Certificates button.
  4. In the Certificate Authentication popup, click the Create Client Certificate button.
  5. Optionally enter a name for the certificate.
  6. Enter or select the number of days before the certificate is automatically expired. The server administrator configures the maximum number of allowed days, which is displayed below the expiration days pull down.
  7. Click the Create Certificate button.
  8. Click the Download a Certificate button to download the .pem file, which can then be used when you make a REST calls to the server. Unlike Personal Access Tokens, the user can redownload the certificate at any time.
  9. Store the certificate safely and use it in any REST calls to the server that uses the "X-Client-Certificate" header and entering the contents of the .pem file.