Re: Installing replacement certs
Jon Paris <[email protected]> Sun, 7 May 2023 16:53:53 -0400
| Newsgroups | gmane.comp.systems.as400.web |
|---|---|
| Message-ID | <[email protected]> |
OK - I just used copy/paste to create the individual certs. Thanks for the help it is all working now. Jon P. > On May 7, 2023, at 4:33 PM, Brad Stone <[email protected]> wrote: > > You export the CAs from your certificate. Import them from the highest to > lowest, then import the CA. you can't do bundles, correct. That's why you > export the CAs one at a time from the certificate. > > > > On Sun, May 7, 2023 at 2:27 PM Jon Paris <[email protected]> wrote: > >> There's no mention of a "bundle" there Brad that I can see and it talks to >> exporting when I need to import the CAs. >> >> I ended up going back into my notes and finally found what I needed. For >> the sake of anyone who picks up this thread in future ... >> >> >> The IBM DCM won't handle bundles. No idea why. You have to open the >> bundle in a text editor and save off the individual certs contained within >> it. In my case two files. >> >> You then have to import them in the order of precedence. In my case the >> second one had to be imported first, then the first in the bundle. Don't >> know if that is standard. Once both had been imported I could import my own >> cert and it all worked. >> >> I realized that I had had part of this discussion last year on Midrange >> and between what you said and the comments of the time plus my own notes it >> all came together. >> >> >> Sigh ... I long for the day when all this can really be better automated. >> Or at least that a few of the cert issuers included IBM i in their >> instructions. >> >> Thanks to all - hopefully I'll remember all this next year! >> >> >> Jon P. >> >> >> >>> On May 7, 2023, at 2:20 PM, Brad Stone <[email protected]> wrote: >>> >>> No, Jon. It's all there. >>> >>> >> https://docs.bvstools.com/home/ssl-documentation/exporting-certificate-authorities-cas-from-a-website#exporting >>> >>> Go to the section labeled "*Exporting Each Separate CA"* >>> >>> On Sun, May 7, 2023 at 12:08 PM Jon Paris <[email protected]> >> wrote: >>> >>>> Thanks Brad but it doesn't really help. >>>> >>>> I had already done everything up to and including the import. But the >>>> import will not complete because of missing CAs. I _thought_ they were >> in >>>> the .bundle file but I can find zero information on how to handle that >> file >>>> or indeed get the CAs any other way. >>>> >>>> >>>> Jon P. >>>> >>>>> On May 6, 2023, at 5:02 PM, Brad Stone <[email protected]> wrote: >>>>> >>>>> Have DCM create the CSR. >>>>> >>>>> Copy and paste the CSR into the site you're getting the certificate >> from. >>>>> >>>>> Once you have the cert, import it and assign it to your application. >>>>> >>>>> You may need to also import a CA or two from the new cert if they're >> not >>>>> there yet. >>>>> >>>>> I have info here: >>>>> https://docs.bvstools.com/home/ssl-documentation >>>>> >>>>> Article on this (needs to be updated to new DCM): >>>>> >>>> >> https://drive.google.com/file/d/1VxLX1ku7whPVIyetQLqpAYKE_VUFm4D_/view?usp=sharing >>>>> >>>>> >>>>> >>>>> On Sat, May 6, 2023 at 11:17 AM Jon Paris <[email protected]> >>>> wrote: >>>>> >>>>>> I thought I had written all this down but ... >>>>>> >>>>>> My main cert is expiring in a couple of weeks so I set everything up >> and >>>>>> ordered the new certs. So far so good. >>>>>> >>>>>> I have the .crt uploaded but cannot for the life of me remember how to >>>>>> deploy the bundle so that I can activate the cert. >>>>>> >>>>>> I have searched all over the IBM docs but cannot find anything useful. >>>>>> >>>>>> I am using the new DCM which while much better than the old one is not >>>>>> exactly intuitive. >>>>>> >>>>>> Can someone point me to some simple documentation to take me through >>>> this. >>>>>> >>>>>> >>>>>> Jon P. >>>>>> >>>>>> -- >>>>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) >> mailing >>>>>> list >>>>>> To post a message email: [email protected] >>>>>> To subscribe, unsubscribe, or change list options, >>>>>> visit: https://lists.midrange.com/mailman/listinfo/web400 >>>>>> or email: [email protected] >>>>>> Before posting, please take a moment to review the archives >>>>>> at https://archive.midrange.com/web400. >>>>>> >>>>>> >>>>> -- >>>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) >> mailing >>>> list >>>>> To post a message email: [email protected] >>>>> To subscribe, unsubscribe, or change list options, >>>>> visit: https://lists.midrange.com/mailman/listinfo/web400 >>>>> or email: [email protected] >>>>> Before posting, please take a moment to review the archives >>>>> at https://archive.midrange.com/web400. >>>>> >>>> >>>> -- >>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing >>>> list >>>> To post a message email: [email protected] >>>> To subscribe, unsubscribe, or change list options, >>>> visit: https://lists.midrange.com/mailman/listinfo/web400 >>>> or email: [email protected] >>>> Before posting, please take a moment to review the archives >>>> at https://archive.midrange.com/web400. >>>> >>>> >>> -- >>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing >> list >>> To post a message email: [email protected] >>> To subscribe, unsubscribe, or change list options, >>> visit: https://lists.midrange.com/mailman/listinfo/web400 >>> or email: [email protected] >>> Before posting, please take a moment to review the archives >>> at https://archive.midrange.com/web400. >>> >> >> -- >> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing >> list >> To post a message email: [email protected] >> To subscribe, unsubscribe, or change list options, >> visit: https://lists.midrange.com/mailman/listinfo/web400 >> or email: [email protected] >> Before posting, please take a moment to review the archives >> at https://archive.midrange.com/web400. >> >> > -- > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list > To post a message email: [email protected] > To subscribe, unsubscribe, or change list options, > visit: https://lists.midrange.com/mailman/listinfo/web400 > or email: [email protected] > Before posting, please take a moment to review the archives > at https://archive.midrange.com/web400. > -- This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list To post a message email: [email protected] To subscribe, unsubscribe, or change list options, visit: https://lists.midrange.com/mailman/listinfo/web400 or email: [email protected] Before posting, please take a moment to review the archives at https://archive.midrange.com/web400.