Re: SSL Renewal Issues

[Matt Lavinder <mlavinder@xxxxxxxxxxxxxxxxxxx>]

Verisign support helped us.  We had to create a new request in the *SYSTEM
certificate store, revoke the old certificate, and create a new.  After
doing all that we were able to upload the new certificate with no issues.
So apparently the issue was with the certificate store.  Everything is
working now.

As a side note, I was pretty impressed with Verisign's support.  They seemed
to be knowledgeable about DCM and configuring SSL in the IBM i environment.



On Tue, Jun 21, 2011 at 9:51 AM, Matt Lavinder <
mlavinder@xxxxxxxxxxxxxxxxxxx> wrote:

> You will have to pardon my ignorance as this is my first time setting up
> SSL certificates.
>
> Yesterday we created a new Certificate Signing Request (CSR) and submitted
> it to Verisign.  They have sent us back a certificate, but when I go to
> import it, I get this message:
>
>      An error occurred during certificate validation. The issuer of the
> certificate may not be in the certificate store or the issuer may not be
> enabled
>
> The CSR we generated had to have a 2048 key to comply with new standards
> Verisign has in place.  I believe the new standards don't go into affect
> until 2012 or 2013, but we were renewing for 3 years, so they made us use
> the longer key.
>
> My first question is: does IBM i support the 2048 key?
>
> Next, when I created the certificate, I did not create the it in the
> *SYSTEM Certificate Store.  I realized I had messed that up after we had
> sent the CSR to Verisign.  I was hoping we could just move the certificate
> to the appropriate store after the fact (export and then import). Currently
> I am handling all this in the *OBJECTSIGNING store.   Two questions:
>
> Would the certificate store I am using cause this issue?
> Will I be able to move the certificate to the *SYSTEM certificate store, as
> I am hoping, or do I need to start over?
>
> Thanks for the help.