Re: Letsencrypt

Hello Jay,

Am 01.08.2020 um 16:17 schrieb Jay Vaughn <jeffersonvaughn@xxxxxxxxx>:

I hear you on the get what you pay for part of it!

IBM i yearly rent seems enough that wholesome support for Letsencrypt-Certs without any DNS-tweaking from IBM is easily justified. Besides, you were the first one bringing up the Letsencrypt topic. ;-)

Reviewing your OP: Letsencrypt does *not* support intermediate certs to be signed. Only for end devices.

I have a web app I want to make api requests to IBMi. I can produce the cert with DCM and export to .pfx for client (And that works) but don’t want to have to be manual effort to apply that .pfx cert to all clients that visit website. Make sense?

This is what CAs are for. You give a Certificate Request to the CA for signing and approving that the key is legit. All clients having the CA's certificate will then accept the (signed) certificate.

pfx is just a container for either the Request, the (signed) cert, or the private key (which you should never give out to anyone).

:wq! PoC

PGP-Key: DDD3 4ABF 6413 38DE - https://www.pocnet.net/poc-key.asc