Re: Installing replacement certs
Brad Stone <[email protected]> Sun, 7 May 2023 15:34:36 -0500
| Newsgroups | gmane.comp.systems.as400.web |
|---|---|
| Message-ID | <CAAGV8Of+Jabau4+6Z8gACEAGT6d06Mn6WCjMe8X6L6_cP47WLA@mail.gmail.com> |
Let me clarify. 1. Export CAs from your certificate. 2. Import those CAs into the *SYSTEM store using DCM 3. Import the certificate. Just like I said the first time: >>> Once you have the cert, import it and assign it to your application. >>> >>> You may need to also import a CA or two from the new cert if they're not >>> there yet. On Sun, May 7, 2023 at 3:33 PM Brad Stone <[email protected]> wrote: > You export the CAs from your certificate. Import them from the highest to > lowest, then import the CA. you can't do bundles, correct. That's why you > export the CAs one at a time from the certificate. > > > > On Sun, May 7, 2023 at 2:27 PM Jon Paris <[email protected]> wrote: > >> There's no mention of a "bundle" there Brad that I can see and it talks >> to exporting when I need to import the CAs. >> >> I ended up going back into my notes and finally found what I needed. For >> the sake of anyone who picks up this thread in future ... >> >> >> The IBM DCM won't handle bundles. No idea why. You have to open the >> bundle in a text editor and save off the individual certs contained within >> it. In my case two files. >> >> You then have to import them in the order of precedence. In my case the >> second one had to be imported first, then the first in the bundle. Don't >> know if that is standard. Once both had been imported I could import my own >> cert and it all worked. >> >> I realized that I had had part of this discussion last year on Midrange >> and between what you said and the comments of the time plus my own notes it >> all came together. >> >> >> Sigh ... I long for the day when all this can really be better >> automated. Or at least that a few of the cert issuers included IBM i in >> their instructions. >> >> Thanks to all - hopefully I'll remember all this next year! >> >> >> Jon P. >> >> >> >> > On May 7, 2023, at 2:20 PM, Brad Stone <[email protected]> wrote: >> > >> > No, Jon. It's all there. >> > >> > >> https://docs.bvstools.com/home/ssl-documentation/exporting-certificate-authorities-cas-from-a-website#exporting >> > >> > Go to the section labeled "*Exporting Each Separate CA"* >> > >> > On Sun, May 7, 2023 at 12:08 PM Jon Paris <[email protected]> >> wrote: >> > >> >> Thanks Brad but it doesn't really help. >> >> >> >> I had already done everything up to and including the import. But the >> >> import will not complete because of missing CAs. I _thought_ they >> were in >> >> the .bundle file but I can find zero information on how to handle that >> file >> >> or indeed get the CAs any other way. >> >> >> >> >> >> Jon P. >> >> >> >>> On May 6, 2023, at 5:02 PM, Brad Stone <[email protected]> wrote: >> >>> >> >>> Have DCM create the CSR. >> >>> >> >>> Copy and paste the CSR into the site you're getting the certificate >> from. >> >>> >> >>> Once you have the cert, import it and assign it to your application. >> >>> >> >>> You may need to also import a CA or two from the new cert if they're >> not >> >>> there yet. >> >>> >> >>> I have info here: >> >>> https://docs.bvstools.com/home/ssl-documentation >> >>> >> >>> Article on this (needs to be updated to new DCM): >> >>> >> >> >> https://drive.google.com/file/d/1VxLX1ku7whPVIyetQLqpAYKE_VUFm4D_/view?usp=sharing >> >>> >> >>> >> >>> >> >>> On Sat, May 6, 2023 at 11:17 AM Jon Paris <[email protected]> >> >> wrote: >> >>> >> >>>> I thought I had written all this down but ... >> >>>> >> >>>> My main cert is expiring in a couple of weeks so I set everything up >> and >> >>>> ordered the new certs. So far so good. >> >>>> >> >>>> I have the .crt uploaded but cannot for the life of me remember how >> to >> >>>> deploy the bundle so that I can activate the cert. >> >>>> >> >>>> I have searched all over the IBM docs but cannot find anything >> useful. >> >>>> >> >>>> I am using the new DCM which while much better than the old one is >> not >> >>>> exactly intuitive. >> >>>> >> >>>> Can someone point me to some simple documentation to take me through >> >> this. >> >>>> >> >>>> >> >>>> Jon P. >> >>>> >> >>>> -- >> >>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) >> mailing >> >>>> list >> >>>> To post a message email: [email protected] >> >>>> To subscribe, unsubscribe, or change list options, >> >>>> visit: https://lists.midrange.com/mailman/listinfo/web400 >> >>>> or email: [email protected] >> >>>> Before posting, please take a moment to review the archives >> >>>> at https://archive.midrange.com/web400. >> >>>> >> >>>> >> >>> -- >> >>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) >> mailing >> >> list >> >>> To post a message email: [email protected] >> >>> To subscribe, unsubscribe, or change list options, >> >>> visit: https://lists.midrange.com/mailman/listinfo/web400 >> >>> or email: [email protected] >> >>> Before posting, please take a moment to review the archives >> >>> at https://archive.midrange.com/web400. >> >>> >> >> >> >> -- >> >> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) >> mailing >> >> list >> >> To post a message email: [email protected] >> >> To subscribe, unsubscribe, or change list options, >> >> visit: https://lists.midrange.com/mailman/listinfo/web400 >> >> or email: [email protected] >> >> Before posting, please take a moment to review the archives >> >> at https://archive.midrange.com/web400. >> >> >> >> >> > -- >> > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) >> mailing list >> > To post a message email: [email protected] >> > To subscribe, unsubscribe, or change list options, >> > visit: https://lists.midrange.com/mailman/listinfo/web400 >> > or email: [email protected] >> > Before posting, please take a moment to review the archives >> > at https://archive.midrange.com/web400. >> > >> >> -- >> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing >> list >> To post a message email: [email protected] >> To subscribe, unsubscribe, or change list options, >> visit: https://lists.midrange.com/mailman/listinfo/web400 >> or email: [email protected] >> Before posting, please take a moment to review the archives >> at https://archive.midrange.com/web400. >> >> -- This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list To post a message email: [email protected] To subscribe, unsubscribe, or change list options, visit: https://lists.midrange.com/mailman/listinfo/web400 or email: [email protected] Before posting, please take a moment to review the archives at https://archive.midrange.com/web400.