Re: TLS/SSL Certificate update for IBM i ODBC

[Justin Taylor <jtaylor.0ab@xxxxxxxxx>]

Yes.  AFAIK, you have to intsall the cert on every ODBC client whenever the
cert changes.  Why does ODBC require it, when 5250 and Apache don't?
That's a good question, and I'd love to know the answer.



date: Fri, 1 Mar 2024 14:50:22 +0000
> from: "Sizer, Joseph via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
> subject: TLS/SSL Certificate update for IBM i ODBC
>
> Each year I use Digital Certificate Manager (DCM) to import my new SSL
> cert.  My root and CA cert are still good.  I then assign the new SSL cert
> to the applications that require them based on what last year's cert was
> assigned to.  I then verify that telnet, IBM i HTTP servers, etc. are all
> using the new SSL cert.
>
> This year, a client PC that uses a System DSN 64-bit ODBC connection to
> the IBM I for a Microsoft Word mail merge, generated an error that defined
> the SSL cert as not being trusted.  I am using ODBC driver IBM I Access
> ODBC Driver version 13.64.27.00 and ACS version 1.1.9.4.
>
> The error message generated when testing the connection is:
> Data link error: Test connection failed because of an error in
> initializing provider.  IBM System I Access ODBC Driver Communication link
> failure.  Comm rc-25414 - CWBCO1050 - The IBM I server application
> certificate is not trusted.
>
> Changing the ODBC driver configuration to Non-SSL allows the mail merge to
> work (Configure / Connection Options / Security - Do not user Secured
> Sockets Layer (SSL)
>
> Telnet (ACS) does not require any update at the PC client level.  Is
> anyone aware of a requirement where a PC client ODBC connect must run an
> update for a new SSL cert?  I would like to switch the connection back to
> SSL.
>
> Thanks.
>
>
> Joe Sizer
> IBM I Power Systems Administrator
> Pencor Digital Services