Author Topic: SSL on z/OS  (Read 2548 times)

Nolan

  • Full Member
  • ***
  • Posts: 115
    • View Profile
Re: SSL on z/OS
« Reply #15 on: August 17, 2018, 12:26:23 PM »
It was going smoothly, till I tried to log in!  I get  'Connection cannot be established ....' with no messages in STC or system log table.

ars.ini
SSL_PORT=1446                 
SSL_KEYRING_FILE=ssltring     
SSL_KEYRING_LABEL=PP1TSERV_TEST
SSL_CLNT_USE_SSL=0             

List of Cert in ondemand.kdb (we have internally trusted certs, so I added them to the db)
!       RBC.ROOT
!       RBC.INT1
!       RBC.INT2
!       PP1TSERV_TEST

Client
Use Secure Sockets Layer is enabled.

Any suggestions on how I can trace what is not set up right?

Thanks
J.

#zOS #AIX #Windows #Multiplatforms
#DB2 #TSM #ODF #zODF #ODWEK
#CapacityPlanning #AFP #ReportDistribution
#Finance #ICN

Justin Derrick

  • IBM Content Manager OnDemand Consultant
  • Administrator
  • Hero Member
  • *****
  • Posts: 1552
  • CMOD Guru for hire...
    • View Profile
    • Tenacious Consulting
Re: SSL on z/OS
« Reply #16 on: August 20, 2018, 02:55:01 AM »
It looks like you're using custom/internal Certificates, and not the default ones that are included in the GSKit.  You need to add these certificates to the Client's certificate chain in order to be able to connect to a server that's using a different certificate chain.

-JD.
#Install, #Educate, #Repair, #Upgrade, #Migrate, #Enhance, #Optimize.

IBM CMOD Professional Services: http://TenaciousConsulting.com
Call:  +1-866-533-7742  or  eMail:  jd@justinderrick.com
IBM CMOD Wiki:  https://CMOD.wiki/

Interests: #AIX #Linux #Multiplatforms #DB2 #TSM #SA #Performance #Security #Audits #Customizing #Availability #HA #DR #Training

Nolan

  • Full Member
  • ***
  • Posts: 115
    • View Profile
Re: SSL on z/OS
« Reply #17 on: August 20, 2018, 12:42:43 PM »
I had added them; RBC.ROOT and RBC.INT1/2 were supposed to create the trust chain.  When I run the validate commands

ROOT:  validates ok.

INT: 
CTGSK2052W An invalid basic constraint extension was found.
CTGSK2052W An invalid basic constraint extension was found.

Google hasn't helped me figure out how to fix it.  :(

I opened a PMR, hoping for help there :)

J.

#zOS #AIX #Windows #Multiplatforms
#DB2 #TSM #ODF #zODF #ODWEK
#CapacityPlanning #AFP #ReportDistribution
#Finance #ICN

Justin Derrick

  • IBM Content Manager OnDemand Consultant
  • Administrator
  • Hero Member
  • *****
  • Posts: 1552
  • CMOD Guru for hire...
    • View Profile
    • Tenacious Consulting
Re: SSL on z/OS
« Reply #18 on: August 20, 2018, 04:24:09 PM »
I found this, which seems to have a solution...

https://developer.ibm.com/answers/questions/271880/ctgsk2052w-error-from-runmqakm-when-using-8002-and.html

"-ca true" is missing from the documentation in this thread.

-JD.
#Install, #Educate, #Repair, #Upgrade, #Migrate, #Enhance, #Optimize.

IBM CMOD Professional Services: http://TenaciousConsulting.com
Call:  +1-866-533-7742  or  eMail:  jd@justinderrick.com
IBM CMOD Wiki:  https://CMOD.wiki/

Interests: #AIX #Linux #Multiplatforms #DB2 #TSM #SA #Performance #Security #Audits #Customizing #Availability #HA #DR #Training

Nolan

  • Full Member
  • ***
  • Posts: 115
    • View Profile
Re: SSL on z/OS
« Reply #19 on: August 20, 2018, 06:26:09 PM »
Thanks, I had also seen that thread but -ca true gives invalid parm.  The option -trust enable is what I used but it is now deprecated. 

It does list it in the details that ca = true

basicConstraints
        ca = true
        pathLen = 1633108


PMR opened.  Will let you know when I find the solution.
J.

#zOS #AIX #Windows #Multiplatforms
#DB2 #TSM #ODF #zODF #ODWEK
#CapacityPlanning #AFP #ReportDistribution
#Finance #ICN

Justin Derrick

  • IBM Content Manager OnDemand Consultant
  • Administrator
  • Hero Member
  • *****
  • Posts: 1552
  • CMOD Guru for hire...
    • View Profile
    • Tenacious Consulting
Re: SSL on z/OS
« Reply #20 on: August 21, 2018, 05:17:43 AM »
Yeah, the PMR is the way to go, but I'll caution you that GSKit doesn't get a lot of love from IBM in terms of updates.  Even really bad bugs persist for months at a time -- although I suppose the reason is that they're trying to fix it right, which is precisely what you want with an encryption library.  :)

-JD.
#Install, #Educate, #Repair, #Upgrade, #Migrate, #Enhance, #Optimize.

IBM CMOD Professional Services: http://TenaciousConsulting.com
Call:  +1-866-533-7742  or  eMail:  jd@justinderrick.com
IBM CMOD Wiki:  https://CMOD.wiki/

Interests: #AIX #Linux #Multiplatforms #DB2 #TSM #SA #Performance #Security #Audits #Customizing #Availability #HA #DR #Training

Ed_Arnold

  • Hero Member
  • *****
  • Posts: 780
    • View Profile
Re: SSL on z/OS
« Reply #21 on: August 22, 2018, 12:55:56 AM »
Hmmm -  i have the following:

SSL_KEYRING_FILE=ARSSOC95.SSLRING

which was created by:

RACDCERT ID(ARSSV950) ADDRING(ARSSOC95.SSLRING)

You have:

SSL_KEYRING_FILE=ssltring   

a) make sure the case is correct as I think it's case sensitive

b) try adding the server instance owner to that parm with a slash as a delimiter, for example

SRVR_INSTANCE_OWNER=ARSSERVR

SSL_KEYRING_FILE=ARSSERVR/ssltring
________

Also, run the display commands I have here...

http://www.odusergroup.org/forums/index.php?topic=1987.msg9972#msg9972

...and make sure what you see makes sense.

Ed

#zOS #ODF

Nolan

  • Full Member
  • ***
  • Posts: 115
    • View Profile
Re: SSL on z/OS
« Reply #22 on: August 27, 2018, 01:29:46 PM »
I have had a few more bumps on this ride.

We are using internal certificates and the GSK8 is not handling the chain of certificates.  For some reason, our ROOT is not marked critical for BasicConstraints extension and our intermediate is.  Not sure yet how to resolve that.  Hoping the PMR will advise how to handle it.

I did revert to a Self Signed certificate using the gskkyman method.  Following that, I was able to setup SSL from the client to the server successfully.
Note in Step 2 in the guide, it is missing instructions to create the stash file.
From the main gskkyman pannel do 2. Open DB, enter the db name, enter the password, select 10 to store database password.
It will display the path and file name of the stash file required for your ars.ini in Step 3.

Now, I have a problem with my remote loading of PDF documents where it is now picking up extra characters to the AG name causing it to fail.  Will start looking at the local report specification exit.  ::)
J.

#zOS #AIX #Windows #Multiplatforms
#DB2 #TSM #ODF #zODF #ODWEK
#CapacityPlanning #AFP #ReportDistribution
#Finance #ICN