Re: Anyone Familiar with How Server Farms and SSL Certificates Work?

On Wed, Dec 14, 2016 at 11:44 AM, Chris Bipes <chris.bipes@xxxxxxxxxxxxxxx>
wrote:

It really depends on the application and if the programmer chooses to
validate the certificates or not.

I have one application that does not validate the certificate chain at all
as the trading partner is on MPLS and using a self-signed certificate. (No
CA.)
I have another application that requires us to validate the entire chain.
(Trading partner's requirement.)
So I have coded my programs accordingly. For instance if you are using
the HTTP API from Scott Klement you can use the HTTPS_STRICT API.

From the example on how to use the https_strict API.

callp https_strict(*ON);

(By default, HTTPAPI instructs i5/OS to ignore any SSL errors related to
untrusted root certs, or expired certificates, as long as they contain
enough information to enable encryption.

The https_strict() API can turn "strict checking" on or off.

When on, i5/OS will only allow root certificates that are registered as
"trusted" in the DCM. It will also only allow certificates that are not
expired.)

For years I've thought about adding this option to my software but every
time I do I think "Its there for a reason.." Every time there's an issue
like this I think I may just add it in anyhow.

I imagine if you ignore handshake errors there goes any type of compliance
you may required.

It should would be hard to track down, though.. haha..

Brad
www.bvstools.com