How to Configure SSL / TLS Connections with the IBM Toolbox for Java Driver in WebSphere Application Server (WAS)

Create a self-signed certificate within IBM Digital Certificate Manager and assign it to the necessary applications.

a. Open a browser window and go to the following URL:
http://<server>:2001/QIBM/ICSS/Cert/Admin/qycucm1.ndm/main0
where <server> is the IP address or Fully Qualified Host Name (FQDN) of your IBM i server.  i.e. 10.1.1.1 or as400.ibm.com
b. Sign into the *SYSTEM Certificate Store.

• Click on the Select a Certificate Store button.

• Select the *SYSTEM store and click Continue.
• Enter your certificate store password and click Continue.

NOTE:  If you do not know your *SYSTEM store password, you can click on the "Reset Password" button to change it.

c. Create a self-signed certificate and assign it to the required applications.

• After signing in, click the Create Certificate link in the left-hand, vertical menu bar.

• Select Server or client certificate and click Continue.
• Select Local Certificate Authority and click Continue.
• Select your Certificate Authority, Key Algorithm, and Key Size.  Then, fill in the Certificate label (any unique name will do), Common name (the FQDN of the server; for example, as400.ibm.com), Organization name, State, and Country. We also recommend the "Fully qualified domain name" field under Subject Alternative Name be set to your IBM i FQDN.  Then, click Continue.

• Select the necessary applications you are accessing in order to assign the newly created certificate.

NOTE: IBM recommends you select the Central, Database, Data Queue, Network Print, Remote Command, Signon,  IBM i DDM/DRDA Server, Host Servers, and File Server applications.  You can also secure the IBM i Telnet Server and Management Central server as well.

- If you are accessing the DB2, you will need to select the Database Server and the Signon Server.
- If you are accessing the File Server, select the File Server and the Signon Server.
- If you are accessing the Remote Command Server, select the Remote Command Server and the Signon Server, and so on.

• Click Replace at the bottom of the page.

You should receive a message stating The application you selected will use this certificate to indicate a successful creation and assignment.

Download the CA certificate from DCM and import into WebSphere.

There are two options available to perform the CA certificate download from DCM and import into WebSphere. The easiest option (Option a) is listed first. Option b should only be used when Option a fails.

a. Use the "Retrieve from port" feature within WebSphere to automatically download the CA certificate from the IBM i Server and import it into WebSphere.

• Log into the IBM Integrated Solutions Console for WebSphere by doing the following:

Open a Web browser and go to the IBM Integrated Solutions Console (in other words, IBM WebSphere Administrative Console); for example, http://<server>:<adminPort>/ibm/console
where <server> is the FQDN (in other words, as400.ibm.com); <adminPort> is the WAS profile administrative port.

Note: The adminPort value can be found by displaying the WAS joblog, locating the WebSphere Application Server is ready message, and displaying the second-level text of the message. The second-level text will indicate the administrative port number.

• Expand the Security section in the left-hand, vertical menu bar click on the SSL certificate and key management link.

• Click on the Key stores and certificates link under Related Items.

• Click on the NodeDefaultTrustStore link under the Name column.

Note: In an Network Deployment (ND) environment, click on the CellDefaultTrustStore link under the Name column.

• Click on the Signer certificates link under the Additional Properties section.

 

• Click on Retrieve from port to retrieve the certificate from the IBM i Access Database Host Server directly.

• First, enter in the host name of the IBM i Server you wish to retrieve the SSL Certificate from (for example, AS400.IBM.COM). This information can be obtained from CFGTCP Option 12. Second, enter a value of 9471 for the port number. This is the SSL port number for the Database Host Server. Third, enter an alias value for the certificate. This has to be a unique name in the Trust Store. Finally, click Retrieve signer information, and then click OK.

• Save the changes to the master configuration. After doing so, you will see the new certificate in the trust store.

b. Manually download the CA certificate from DCM and import it into WebSphere.

• Open a browser window and go to the following URL:

http://<server>:2001/QIBM/ICSS/Cert/Admin/qycucm1.ndm/main0

where <server> is the IP address or Fully Qualified Host Name (FQDN) of your IBM i server.  i.e. 10.1.1.1 or as400.ibm.com
 

• Click on the Select a Certificate Store button.
• Select the *SYSTEM store and click Continue.
• Enter your certificate store password and click Continue.

NOTE:  If you do not know your *SYSTEM store password, you can click on the "Reset Password" button to change it.

• In DCM, click on the Install Local CA Certificate on Your PC link in the left-hand, vertical menu bar.

• Click on the Copy and past certificate link under the To copy and past the certificate to a file on your PC section in the right pane.

IBM i 7.1 and earlier:

IBM i 7.2 and later:

• Highlight the entire certificate text, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

• Open a text editor (such as Notepad), and paste the certificate data into the new text file.
• Save the file as MYSYS.cer (replace MYSYS with the system name, as appropriate).

• Finally, you can now click OK in the browser and exit DCM.
• Copy the MYSYS.cer file from your PC to the /home directory on the IBM i Server.
  • Available methods to copy the data to the server: SSH, FTPS (ASCII mode), Mapped Network Drive.
• Start the WebSphere Application Server profile if it is not already started.

a. STRQSH
b. /QIBM/ProdData/WebSphere/AppServer/<version>/<edition>/bin/startServer -profileName <profileName>
where <version>= V7, V8. V85, or V9; <edition>=Express, Base, or ND; and <profileName>=The name of the WAS profile you wish to start (case-sensitive).
 

• Import the Local CA into the NodeDefaultTrustStore and/or CellDefaultTrustStore certificate store.
• Open a Web browser and go to the IBM Integrated Solutions Console (in other words, the IBM WebSphere Administrative Console); for example, http://<server>:<adminPort>/ibm/console

where <server> is the FQDN (in other words, as400.ibm.com); <adminPort> is the WAS profile administrative port.

Note: The adminPort value can be found by displaying the WAS instance's job log, locating the "WebSphere Application Server is ready" message, putting the cursor on this message and pressing F1.  This will display the message's second level text, which will indicate the administrative port number (adminPort) to use in the URL.
 

• Expand the Security section in the left-hand, vertical menu bar click on the SSL certificate and key management link.

 

• Click on the Key stores and certificates link under Related Items.

 

• Click on the NodeDefaultTrustStore link under the Name column.

Note: In an Network Deployment (ND) environment, click on the CellDefaultTrustStore link under the Name column.

• Click on the Signer certificates link under the Additional Properties section.
• Click on the Add button to add a new certificate to the certificate store.

 

• Enter an Alias and the path to the Local CA certificate that you moved to the IFS of the server. Then, click OK to add the certificate.

Set the connection to use SSL/TLS.

Non-JDBC Connections: Implement the SecureAS400 class instead of the non-SSL AS400 class. Please refer to the SecureAS400 javadoc URL: https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/rzahh/ssl.htm
JDBC Connections: Implement the secure=true JDBC connection property to set the connection to use SSL.

a. In the IBM Integrated Solutions Console, expand Resources -> JDBC and click on Data sources.

b. Click on the data source name you accessing in your Web application to display its configuration properties.
c. Click on Custom properties link under the Additional Properties section to view the custom data source properties.

d. Locate the secure property on the second page and click on the property name to edit its value.
e. Change the value of the secure property to true and then click on OK.

Restart the application server (node).

a. STRQSH
b. /QIBM/UserData/WebSphere/AppServer/<version>/<edition>/profiles/<profileName>/bin/stopServer
c. /QIBM/UserData/WebSphere/AppServer/<version>/<edition>/profiles/<profileName>/bin/startServer
where <version>=V7, V8, V85, or V9; <edition>=Express, Base, or ND; and <profileName>=The name of the WAS profile you wish to start (case-sensitive)

Test the JDBC connection.

a. In the data source configuration, click on the Test connection button.
NOTE: A JAAS - J2C Authentication entry is required to be assigned to the component-managed authentication alias under Security Settings in the Data Source configuration.


b. If everything is set up correctly, you should receive a message similar to the following: The test connection operation for data source <dataSource> on server <server> at node <node> was successful.


c. If the test connection does not complete successfully, review the error message(s) and contact the IBM i Global Support Center at 1-800-IBM-SERV (1-800-426-7378) or create an IBM Service Request for further assistance.

Note: If the error message states The certificate issued by xxx is not trusted, there might be a problem with the Local CA certificate you exported from DCM.  Review the Local CA and Server Certificate settings within DCM and what was imported into WAS to resolve the issue.  If you require further assistance, contact the IBM i Global Support Center at 1-800-IBM-SERV (1-800-426-7378) or create an IBM Service Request to open problem ticket.