Configuring TLS Support in a non-Java Db2 client using a certificate file

You can configure Db2 database clients, such as CLI, CLP, and .Net Data Provider clients, to support Transport Layer Security (TLS) for communication with the Db2 server.

About this task

This task shows you how to configure TLS support in a non-Java Db2® client using the signing certificate only. To configure TLS support using a key database, see Configuring TLS Support in a non-Java Db2 client using a keystore

Procedure

  1. Obtain the signing certificate for your Db2 server:
    • If the server certificate is self signed, obtain the certificate that was extracted for distribution to clients.
    • If the server certificate is signed by a 3rd party certificate authority (CA), obtain the CA's root certificate. This can be done by asking the CA, and is usually provided when signing the server certificate.
      Note: The root certificate must be used on the client when configuring TLS support for a CA-signed server certificate.
  2. In the connection string or configuration parameters of your client application, enter the SSLServerCertificate keyword to specify the fully qualified path to a self-signed server certificate or a certificate authority (CA) certificate.

Example

Example 1: Connecting to a database from a CLI/ODBC application, using a connection string:

Use a connection string that contains the SECURITY=SSL and SSLServerCertificate keywords to call the SQLDriverConnect function. For example:
"Database=sampledb; Protocol=tcpip; Hostname=myhost; Servicename=50001; 
Security=ssl; SSLServerCertificate=/home/db2inst1/servercert.pem;"

Example 2: Connecting to a database from a CLI/ODBC application, using a db2cli.ini configuration file:

Use the db2cli.ini file to set the needed connection parameters:
[sampledb]
Database=sampledb
Protocol=tcpip
Hostname=myhost
Servicename=50001
Security=ssl
SSLServerCertificate=/home/db2inst1/servercert.pem

Example 3: Connecting to a database from a CLI/ODBC application, using the SQLDriverConnect function (CLI):

Use the FileDSN CLI/ODBC keyword to identify a DSN file from which a connection string is built for connecting to the Db2 server. You specify the value of FileDSN in the connection string of the SQLDriverConnect function.

The following example shows how the DSN file might be written: 
[ODBC]
DRIVER=IBM DB2 ODBC DRIVER – DB2COPY1
UID=user1
AUTHENTICATION=SERVER
PORT=50001
HOSTNAME=myhost
PROTOCOL=TCPIP
DATABASE=SAMPLEDB
SECURITY=SSL
SSLServerCertificate=/home/db2inst1/servercert.pem

Example 4: Connecting to a database from a CLI/ODBC application or embedded SQL application, using the db2dsdriver.cfg configuration file.

If you are running Db2 11.5.7 or later, you can include the SSLServerCertificate keyword in the db2dsdriver.cfg configuration file to connect from an embedded SQL application.

The following example shows how the db2dsdriver.cfg configuration file might be written:
<dsn alias="sample" host="myhost.ibm.com" name="sample" port="50001">
   <parameter name="SSLServerCertificate" value="/home/db2inst1/servercert.pem"/>
   <parameter name="SecurityTransportMode" value="SSL"/>
</dsn>