Db2 SSL certificate

1. Ensure that the file rootCA.pem exists at /mnt/blumeta0/db2/ssl_keystore on both the source and target systems.
2. Run the bludr-configure-certs.sh script on the source system.
   • The script is packaged with Db2 11.5.5.
   • You must run the script under the dsadm user ID.
   • If you are enabling replication for the first time, the script asks for a database user ID and password for both the source and target.

   The format of the command to run the script is as follows:

   /opt/ibm/bludr/scripts/bin/bludr-configure-certs.sh source_hostname target_hostname

   • source_hostname: The fully qualified host name of the source. This name should match the CN in the HTTPS certificate.
   • target_hostname: The fully qualified host name of the target. This name should match the CN in the HTTPS certificate.

   The script asks if you want to trust or not. Always enter Y.

   The script exchanges the Db2 SSL certificates between source and target so that the replication source can access the target Db2 database. It also restarts the replication REST servers on the source and target so that the changes take effect.

1. Ensure that the file rootCA.pem exists at /mnt/blumeta0/db2/ssl_keystore on both the source and target systems.
2. Run the bludr-configure-certs.sh script on the source system.
   • The script is packaged with Db2 11.5.5.
   • You must run the script under the dsadm user ID.

   The format of the command to run the script is as follows:

   /opt/ibm/bludr/scripts/bin/bludr-configure-certs.sh source_hostname source_username source_password target_hostname target_username target_password trust/notrust
   

   • source_hostname: The fully qualified host name of the source. This name should match the CN in the HTTPS certificate.
   • target_hostname: The fully qualified host name of the target. This name should match the CN in the HTTPS certificate.
   • trust/notrust: You can always use the trust option.

   The script exchanges the Db2 SSL certificates between source and target so that the replication source can access the target Db2 database. It also restarts the replication REST servers on the source and target so that the changes take effect.

1. Ensure that a valid Db2 SSL certificate must be in the source and target keystores and the rootCA.pem file must be in the /mnt/blumeta0/db2/ssl_keystore directory.
2. Import the source Db2 SSL certificate in /mnt/blumeta0/db2/ssl_keystore/rootCA.pem to the source replication trust store.
3. Import the target Db2 SSL certificate into the target system Db2 SSL keystore, replication trust store, and DSWEB JDK trust store.
4. Copy the target certificate rootCA.pem that is located at /mnt/blumeta0/db2/ssl_keystore to the source server and place it at the location ${BLUDR_SHARED_DIR}/certificates in the format rootCA_target_hostname.pem.
5. Copy the source certificate rootCA.pem that is located at /mnt/blumeta0/db2/ssl_keystore to the target server and place it at the location ${BLUDR_SHARED_DIR}/certificates in the format rootCA_source_hostname.pem.
6. On both the source and target systems, download the bludr-add-db2-sslcert.sh script file from the IBM® support site. The script imports the certificate for a specific hostname located at ${BLUDR_SHARED_DIR}/certificates in the format rootCA_hostname.pem into the local DB2® client keystore and the replication keystore.
7. Save the script file to the /opt/ibm/bludr/scripts/bin directory inside the Db2 container. The directory is owned by dsadm:db2iadm1 with permission bits 640.
8. Run the script on the source, providing the target hostname. The syntax is as follows:

   /opt/ibm/bludr/scripts/bin/bludr-add-db2-sslcert.sh target-hostname

9. Run the script on the target, providing the source hostname. The syntax is as follows:

   /opt/ibm/bludr/scripts/bin/bludr-add-db2-sslcert.sh source-hostname

10. If you are running the script on the source, restart the replication REST server on the source system. If you are running the script on the target, restart the replication REST server on the target system.

See Generating and using self-signed certificates.