RE: Digital Certificate expire dates?

I would suggest that you use the special value *NOPWD as shown below for the
password to avoid having to hardcode the password or store it in a SQL
Variable.

You still need *ALLOBJ and *SECADM Special Authorities.

Note the *NOPWD special value also works with the QYCURTVCI API even though
I've never seen it in the API documentation.

SELECT * FROM
TABLE(QSYS2.CERTIFICATE_INFO(CERTIFICATE_STORE_PASSWORD=>'*NOPWD'))
WHERE VALIDITY_END < CURRENT DATE + 3 MONTH

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of K
Crawford
Sent: Monday, December 5, 2022 9:43 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Digital Certificate expire dates?

I just tried it manually in STRSQL and ACS-RSS when I hard coded the PW it
worked fine.
So my issue was in the create or use of variable. Who knows I may have
misspelled it.
Now to decide if I should write something to run this and look at the dates
and send an email. Not too hard but do I want to spend time today. I think
I need to put this in my To do list. other fires.

Thanks for the help.
Kerwin

On Mon, Dec 5, 2022 at 11:32 AM Rob Berendt <rob@xxxxxxxxx> wrote:

The example at the bottom should be what you need They used a variable
for the password but you can hard code it.
The variable is just to spark your imagination so that you consider
storing it encrypted somewhere instead of embedding it.
SQL comes with some encrypting/decrypting operations.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
K Crawford
Sent: Monday, December 5, 2022 12:24 PM
To: Midrange Systems Technical Discussion

<midrange-l@xxxxxxxxxxxxxxxxxx>

Subject: Re: Digital Certificate expire dates?

CAUTION: This email originated from outside of the organization. Do
not click links or open attachments unless you recognize the sender
and know the content is safe.


Rob, I knew that but did not think to change the 5 to a 3. I guess I

was

in too big of a rush. I might need to revisit the SQL and see what
the error was really saying.

We have our Outlook calendar full of these types of reminders. Just

hard

to get them all, and back in 2017 that was not our standard practice.
Kerwin

On Mon, Dec 5, 2022 at 11:17 AM Rob Berendt <rob@xxxxxxxxx> wrote:

It's in 7.3

There's some very basic stuff you need to know when reading IBM
documentation. That link I sent you? If you click on the "Change

version"

and select 7.3 you will see:

https://www.ibm.com/docs/en/i/7.3?topic=services-certificate-info-table-fu
nction

Also notice the difference between the above URL and this URL:

https://www.ibm.com/docs/en/i/7.5?topic=services-certificate-info-table-fu
nction

Basically you swap a 5 for a 3. Not brain surgery...

For a list of when these services came out, and with what PTF see

this:

https://www.ibm.com/support/pages/node/1119123


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf
Of

K

Crawford
Sent: Monday, December 5, 2022 10:46 AM
To: Midrange Systems Technical Discussion

<midrange-l@xxxxxxxxxxxxxxxxxx

Subject: Re: Digital Certificate expire dates?

CAUTION: This email originated from outside of the organization. Do

not

click links or open attachments unless you recognize the sender and

know

the content is safe.


I like the SQL option but that looks like a 7.5 option. Might be

there

in

a year but...
We do get emails from vendors and act on those.
This was an internal Cert that was created for ACS to use SSL, in
the *SYSTEM Certificate Store . It was created back in 2017 and expired
yesterday. Did not take long to renew it but figuring it out in the
early AM was a pain.
Being an internal no email notification. We are a very small shop
and

do

use an IT calendar/email for things like this, but back in 2017 it
did

not

happen. We talked about putting a reminder on the calendar for

2028/05/27

when it is going to expire next time. The other thing I did was put

on

my

EOY checklist to look and see if any are going to expire in the next

365

days and renew them.

Short writing our own doesn't sound like an automated solution exists.

Thanks for the help.
Kerwin

On Mon, Dec 5, 2022 at 9:00 AM Brad Stone <bvstone@xxxxxxxxx> wrote:

Most of the hundreds of more than one man shops I deal with have a

catch

all address (it@xxxxxxxxxxx).

If you don't monitor your email, just close the accounts. :)
It's literally part of the job (to monitor email and be aware of
expiring certificates).

On Mon, Dec 5, 2022 at 8:51 AM Rob Berendt <rob@xxxxxxxxx> wrote:

When you're larger than a one man shop they normally go to
someone

who

couldn't care less.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept
1600 Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On
Behalf

Of

Brad Stone
Sent: Monday, December 5, 2022 9:31 AM
To: Midrange Systems Technical Discussion <

midrange-l@xxxxxxxxxxxxxxxxxx

Subject: Re: Digital Certificate expire dates?

CAUTION: This email originated from outside of the organization.

Do

not

click links or open attachments unless you recognize the sender

and

know

the content is safe.


Also, the company you get the certs from normally send emails

alerting

you

to them expiring at around 30 days.

On Mon, Dec 5, 2022 at 8:30 AM Brad Stone <bvstone@xxxxxxxxx>

wrote:

When you install a new one, put in a company IT calendar an

event a

week

before to let you know to renew it. :)

On Mon, Dec 5, 2022 at 8:28 AM Rob Berendt <rob@xxxxxxxxx>

wrote:

You mean like a job schedule entry based off of this?

https://www.ibm.com/docs/en/i/7.5?topic=services-certificate-info-table-fu
nction

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko
Dept 1600 Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818 Ship to: 7310 Innovation Blvd,
Dock 9C
Ft. Wayne, IN 46818 http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On

Behalf

Of K

Crawford
Sent: Monday, December 5, 2022 9:26 AM
To: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
Subject: Digital Certificate expire dates?

CAUTION: This email originated from outside of the

organization.

Do

not

click links or open attachments unless you recognize the
sender

and

know

the content is safe.


I searched and did not find a way to give us a warning if a

Digital

Certificate is going to expire soon. I saw one discussion
but

short

of

manually checking it..
I see the Check Expiration option in the GUI interface. Any

way

to

have

this send us a message saying 'Digital Certificate is going
to

expire

soon'?

I guess add this to my EOY process. Manual check and if

expiring

renew.

--
KCrawford
--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L)

mailing

list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any

subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L)

mailing

list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any

subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: https://amazon.midrange.com

--
KCrawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our
affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

Help support midrange.com by shopping at amazon.com with our
affiliate
link: https://amazon.midrange.com

--
KCrawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
KCrawford
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
.


.