Re: Create Self Signed Single Level Certificate on i5

[Jeff Young <cooljeff913@xxxxxxxxx>]

Scott,
You are correct that the IBM support rep indicated that DCM could not not do what I wanted.
How would I do this with openssl or the PASE?

Thanks,
 
Jeff Young 
Sr. Programmer Analyst
IBM -e(logo) server Certified Systems Exper - iSeries Technical Solutions V5R2 
IBM  Certified Specialist- e(logo) server i5Series Technical Solutions Designer V5R3
IBM  Certified Specialist- e(logo)server i5Series Technical Solutions Implementer V5R3 


  
 





----- Original Message ----
From: Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, August 28, 2007 4:27:51 PM
Subject: Re: Create Self Signed Single Level Certificate on i5


Hi Jeff,

> I have a client that needs to create a Single Level Self Signed 
> Certificate on the i5 for communicating with an FTP SSL host. The 
> host system requires a single certificate that contains the 
> Certificate Authority and Client Application.

Interesting.  Why do they care whether it's single-level or not?  Seems
like a strange requirement.

> After speaking with IBM support, I was informed that the i5 can not
> do this.

That's not exactly true.  I may be picking nits with your phrasing, 
here, but...  The Digital Certificate Manager in i5/OS cannot do what 
you ask.  However, it's not the i5 itself, but the DCM that has this 
limitation.

You could create the certificate on an i5 using OpenSSL.

So it's not a limitation with the i5 -- it's a limitation with a 
particular software package, the digital certificate manager. 
Unfortunately, since pretty much all software for i5/OS is based on the 
DCM, this puts you in a bit of a bind.

Here's what I don't know:  If you generate a self-signed single level 
certificate via OpenSSL and import it into the DCM, will standard i5/OS 
applications (which are based on the DCM) work?  Or do you have to use 
an OpenSSL-based application for it to work?

In other words, is the limitation only related to generating 
certificates, or does it apply to using existing certificates as well?

If all else fails, you could probably do the whole she-bang in PASE, and 
bypass the DCM.