Configuring Suite B mode

Edit online

Configure a directory server in Suite B mode to secure communications with the TLS 1.2, or TLS 1.3 protocol and the supported Suite B ciphers.

Before you begin

Create a key database file and certificate for the required Suite B cryptographic security level.

For more information, see the Key database, Certificate, and Certificate request chapters in the GSKit tool gsk9certutil_64 user guide GSK9_CertUtil_User_Guide../v11/documents/GSK_CertUtil_UserGuide.pdf.

Set the required permissions (rwx) on the key database file, certificate, and file path for the directory server instance owner.

About this task

You can configure your directory server in Suite B mode to 128 or 192-bit cryptographic security level.

Procedure

  1. Log in as the instance owner.
  2. To configure a directory server for secure communications, run the idsldapmodify command. 
    idsldapmodify -h server.com -p port -D adminDN -w adminPWD -i suiteB_file.ldif
    The suiteB_file.ldif file contains the following entries:
    dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslAuth
ibm-slapdSslAuth: serverClientAuth

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSecurity
ibm-slapdSecurity: SSL

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslKeyDatabase
ibm-slapdSslKeyDatabase: /home/dsrdbm01/keys/serverkey.kdb

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslCertificate
ibm-slapdSslCertificate: serverlabel

dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslKeyDatabasepw
ibm-slapdSslKeyDatabasepw: keyfilePWD
  3. Run the idsldapmodify command to set the ibm-slapdSuiteBMode attribute with an appropriate cryptographic security level.
    To set Suite B mode to 128-bit profile:
      idsldapmodify -h host_name -p port -D adminDN -w adminPWD 
  dn: cn=SSL, cn=Configuration 
  changetype: modify 
  add: ibm-slapdSuiteBMode 
  ibm-slapdSuiteBMode: 128
    To set Suite B mode to 192-bit profile:
      idsldapmodify -h host_name -p port -D adminDN -w adminPWD 
  dn: cn=SSL, cn=Configuration 
  changetype: modify 
  add: ibm-slapdSuiteBMode 
  ibm-slapdSuiteBMode: 192
  4. Restart the directory server and administration server to apply the changes. 
    ibmslapd -I dsrdbm01 -k
ibmdiradm -I dsrdbm01 -k
ibmslapd -I dsrdbm01 -n
ibmdiradm -I dsrdbm01

Examples

Example 1
If a directory server is configured in Suite B mode with the 128-bit cryptographic security, the root DSE search returns the following results:
Run a root DSE search against the directory server:
idsldapsearch -p port -s base -b "" objectclass =* ibm-slapdSuiteBMode

ibm-slapdSuiteBMode=128
Run a root DSE search against the administration server:
idsldapsearch -p admin_port -s base -b "" objectclass =* 
 admindaemon-suitebmode

admindaemon-suitebmode=128
Example 2
If a directory server is configured in Suite B mode with the 192-bit cryptographic security, the root DSE search returns the following results:
Run a root DSE search against the directory server:
idsldapsearch -p port -s base -b "" objectclass =* ibm-slapdSuiteBMode

ibm-slapdSuiteBMode=192
Run a root DSE search against the administration server:
idsldapsearch -p admin_port -s base -b "" objectclass =* 
 admindaemon-suitebmode

admindaemon-suitebmode=192
Example 3
To obtain server trace messages, run the following commands:
ldtrc on
ibmslapd -h 65535 -I dsrdbm01 2>&1 | tee server_trace.txt