Early results.
I went to the Go Daddy site and found their Certificate Chain and their "Go Daddy Class 2 Certification Authority Root Certificate" (DER Format) file and was able to successfully import it to the DCM.
Go Daddy is now a CA on the IBM i.
I will let you know if I get the certificate working as desired.
My thanks to everyone for the help so far. More to come.
Paul
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Fenstermacher
Sent: Tuesday, April 23, 2013 1:40 PM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i
If I'm understanding what you're problem is it's exactly what I'm working on now and here's a very good article with information about the problem.
http://www.itjungle.com/fhg/fhg041713-story03.html
Paul Fenstermacher | Sys/NW Admin,Sr | Corporate Systems - POWER Systems Administration | Jack Henry & Associates, Inc.®
663 West Highway 60 | Monett, MO 65708 | Ph. 417.235.6652 | x177389 | pfenstermacher@xxxxxxxxxxxxx
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Therrien
Sent: Tuesday, April 23, 2013 1:28 PM
To: Midrange Systems Technical Discussion
Subject: RE: SSL and public facing web site on the i
Nathan,
The desire for SLL is exactly as you state - to encrypt communications of user ids and passwords and company data.
The issue that I feel I am having with SSL is my lack of understanding of how to setup the web server with our public certificate.
When I attempt to install the CA certificate on the I, I get the following error from the Digital Certificate Manager:
"An error occurred during certificate validation. The issuer of the certificate may not be in the certificate store or the issuer may not be enabled. "
There are 2 .crt files to install one appears to be the Certificate for the CA and the other is the certificate for our domain.
The big issue is my lack of understanding - both of the SSL installation and the Apache configuration.
Paul
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Nathan Andelin
Sent: Tuesday, April 23, 2013 12:59 PM
To: Midrange Systems Technical Discussion
Subject: Re: SSL and public facing web site on the i
Paul,
SSL only encrypts streams exchanged between the browser and the HTTP server; it doesn't protect the database or other server objects, per se. However you can be confident in exposing the IBM i Apache server to the Internet if you configure it appropriately. The good news is that the Apache server disallows access to everything by default. You must explicitly expose resources via HTTP configuration directives.
If you have SSL working internally, the same configuration for SSL probably works for external users as well. However I suspect that the real problem is that you're unsure about Apache server configuration, in general. You may want to have an expert review your Apache configuration.
-Nathan
----- Original Message -----
From: Paul Therrien <ptherrien@xxxxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion (midrange-l@xxxxxxxxxxxx)" <midrange-l@xxxxxxxxxxxx>
Cc:
Sent: Tuesday, April 23, 2013 9:38 AM
Subject: SSL and public facing web site on the i
Our company has a public web address and a GoDaddy certificate that we currently use for SSL to our webmail that is hosted on an exchange server.
We are developing our first www facing site on the IBM I and want to secure it with SSL. I have made a few stabs at trying to get SSL configured correctly and have managed to get a local CA in place on the IBM I and open the web site internally using SSL. But I am lost as to how to configure SSL and the Apache server on the I.
I am a great (IMHO) software guy, but I am a newbie on web infrastructure.
What do I need to do to allow our web site on the I to be accessible from the internet via our www domain and to incorporate the SLL certificate that we have purchased from GoDaddy?
I appreciate your help.
Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
NOTICE: This electronic mail message and any files transmitted with it are intended exclusively for the individual or entity to which it is addressed. The message, together with any attachment, may contain confidential and/or privileged information.
Any unauthorized review, use, printing, saving, copying, disclosure or distribution is strictly prohibited. If you have received this message in error, please immediately advise the sender by reply email and delete all copies.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
midrange.com
