Re: Installing replacement certs

There's no mention of a "bundle" there Brad that I can see and it talks to exporting when I need to import the CAs.

I ended up going back into my notes and finally found what I needed.  For the sake of anyone who picks up this thread in future ...


The IBM DCM won't handle bundles. No idea why.  You have to open the bundle in a text editor and save off the individual certs contained within it. In my case two files.

You then have to import them in the order of precedence.  In my case the second one had to be imported first, then the first in the bundle. Don't know if that is standard. Once both had been imported I could import my own cert and it all worked.

I realized that I had had part of this discussion last year on Midrange and between what you said and the comments of the time plus my own notes it all came together.


Sigh ... I long for the day when all this can really be better automated.  Or at least that a few of the cert issuers included IBM i in their instructions.

Thanks to all - hopefully I'll remember all this next year!


Jon P.



> On May 7, 2023, at 2:20 PM, Brad Stone <[email protected]> wrote:
> 
> No, Jon.  It's all there.
> 
> https://docs.bvstools.com/home/ssl-documentation/exporting-certificate-authorities-cas-from-a-website#exporting
> 
> Go to the section labeled "*Exporting Each Separate CA"*
> 
> On Sun, May 7, 2023 at 12:08 PM Jon Paris <[email protected]> wrote:
> 
>> Thanks Brad but it doesn't really help.
>> 
>> I had already done everything up to and including the import.  But the
>> import will not complete because of missing CAs.  I _thought_ they were in
>> the .bundle file but I can find zero information on how to handle that file
>> or indeed get the CAs any other way.
>> 
>> 
>> Jon P.
>> 
>>> On May 6, 2023, at 5:02 PM, Brad Stone <[email protected]> wrote:
>>> 
>>> Have DCM create the CSR.
>>> 
>>> Copy and paste the CSR into the site you're getting the certificate from.
>>> 
>>> Once you have the cert, import it and assign it to your application.
>>> 
>>> You may need to also import a CA or two from the new cert if they're not
>>> there yet.
>>> 
>>> I have info here:
>>> https://docs.bvstools.com/home/ssl-documentation
>>> 
>>> Article on this (needs to be updated to new DCM):
>>> 
>> https://drive.google.com/file/d/1VxLX1ku7whPVIyetQLqpAYKE_VUFm4D_/view?usp=sharing
>>> 
>>> 
>>> 
>>> On Sat, May 6, 2023 at 11:17 AM Jon Paris <[email protected]>
>> wrote:
>>> 
>>>> I thought I had written all this down but ...
>>>> 
>>>> My main cert is expiring in a couple of weeks so I set everything up and
>>>> ordered the new certs. So far so good.
>>>> 
>>>> I have the .crt uploaded but cannot for the life of me remember how to
>>>> deploy the bundle so that I can activate the cert.
>>>> 
>>>> I have searched all over the IBM docs but cannot find anything useful.
>>>> 
>>>> I am using the new DCM which while much better than the old one is not
>>>> exactly intuitive.
>>>> 
>>>> Can someone point me to some simple documentation to take me through
>> this.
>>>> 
>>>> 
>>>> Jon P.
>>>> 
>>>> --
>>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
>>>> list
>>>> To post a message email: [email protected]
>>>> To subscribe, unsubscribe, or change list options,
>>>> visit: https://lists.midrange.com/mailman/listinfo/web400
>>>> or email: [email protected]
>>>> Before posting, please take a moment to review the archives
>>>> at https://archive.midrange.com/web400.
>>>> 
>>>> 
>>> --
>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
>> list
>>> To post a message email: [email protected]
>>> To subscribe, unsubscribe, or change list options,
>>> visit: https://lists.midrange.com/mailman/listinfo/web400
>>> or email: [email protected]
>>> Before posting, please take a moment to review the archives
>>> at https://archive.midrange.com/web400.
>>> 
>> 
>> --
>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
>> list
>> To post a message email: [email protected]
>> To subscribe, unsubscribe, or change list options,
>> visit: https://lists.midrange.com/mailman/listinfo/web400
>> or email: [email protected]
>> Before posting, please take a moment to review the archives
>> at https://archive.midrange.com/web400.
>> 
>> 
> -- 
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
> To post a message email: [email protected]
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: [email protected]
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.
> 

-- 
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.