Re: Installing replacement certs

Yes, and it's hard by just looking at the descriptions if you have the
right CAs installed (the names are very obscure/meaningless).  What I do is
try the main cert, and if it complains I import the CA chain certs one at a
time.

When you import the CAs it's like saying "Yes, you can trust certificates
that are signed by these authorities... so import the darn thing already!"
hah..  I think it should automatically import the CAs, but then again DCM
has always been hit and miss.  The new version has a couple nice new
features and is FAST so that's good.  :)

On Mon, May 8, 2023 at 10:07 AM Jon Paris <[email protected]> wrote:

> It was far from clear to me why they were needed as (as far as I could
> tell) the root certs were already installed and had been in use for 12
> months. But something must have changed on the part of the cert authority
> as the new cert would not install until I had added the two new CA certs
> from the bundle.
>
>
> Jon P.
>
> > On May 8, 2023, at 10:40 AM, Brad Stone <[email protected]> wrote:
> >
> > Well, he did say most of the CAs were already there, so maybe that's the
> > case.  I know the last certs I've imported the CAs were already there so
> no
> > importing of CAs required and the "bundle" imported just fine.  :)
> >
> >
> >
> > On Mon, May 8, 2023 at 9:27 AM Jon Paris <[email protected]>
> wrote:
> >
> >> Agreed - in fact it errors out if you try.
> >>
> >> But then I have no idea how Pete gets it to accept a bundle file in the
> >> first place. It ust rejects it for me.
> >>
> >>
> >> Jon P.
> >>
> >>> On May 7, 2023, at 10:34 PM, Brad Stone <[email protected]> wrote:
> >>>
> >>> Using DCM?  I've never been able to import a server cert if the CAs
> >> aren't
> >>> already there.
> >>>
> >>> On Sun, May 7, 2023 at 7:43 PM Pete Helgren <[email protected]> wrote:
> >>>
> >>>> Interesting....I just import the bundle, remembering the "bundle" is
> the
> >>>> cert plus the intermediates (three certs in my case).  The LetsEncrypt
> >>>> CA root is already present (most CA roots are already in DCM).
> >>>>
> >>>> I always just use the same csr since it only needs to be created once,
> >>>> unless your server key changes, or the key length is changed....most
> of
> >>>> my csr's haven't changed in years.
> >>>>
> >>>> The only place I got tripped up in the past when when I imported and
> >>>> forgot to choose "Server or Client" and "Automatically renewed
> >>>> certificate".  But I have fully automated the LetsEncrypt renewals
> with
> >>>> DCM now so I don't have to do a manual import except in rare
> >> occasions.....
> >>>>
> >>>> Pete Helgren
> >>>> www.petesworkshop.com
> >>>> GIAC Secure Software Programmer-Java
> >>>> GIAC Cloud Penetration Tester
> >>>> AWS Certified Cloud Practitioner
> >>>> Microsoft Certified: Azure Fundamentals
> >>>>
> >>>> On 5/7/2023 3:53 PM, Jon Paris wrote:
> >>>>> OK - I just used copy/paste to create the individual certs.
> >>>>>
> >>>>> Thanks for the help it is all working now.
> >>>>>
> >>>>>
> >>>>> Jon P.
> >>>> --
> >>>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)
> mailing
> >>>> list
> >>>> To post a message email: [email protected]
> >>>> To subscribe, unsubscribe, or change list options,
> >>>> visit: https://lists.midrange.com/mailman/listinfo/web400
> >>>> or email: [email protected]
> >>>> Before posting, please take a moment to review the archives
> >>>> at https://archive.midrange.com/web400.
> >>>>
> >>>>
> >>> --
> >>> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)
> mailing
> >> list
> >>> To post a message email: [email protected]
> >>> To subscribe, unsubscribe, or change list options,
> >>> visit: https://lists.midrange.com/mailman/listinfo/web400
> >>> or email: [email protected]
> >>> Before posting, please take a moment to review the archives
> >>> at https://archive.midrange.com/web400.
> >>>
> >>
> >> --
> >> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> >> list
> >> To post a message email: [email protected]
> >> To subscribe, unsubscribe, or change list options,
> >> visit: https://lists.midrange.com/mailman/listinfo/web400
> >> or email: [email protected]
> >> Before posting, please take a moment to review the archives
> >> at https://archive.midrange.com/web400.
> >>
> >>
> > --
> > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> > To post a message email: [email protected]
> > To subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/web400
> > or email: [email protected]
> > Before posting, please take a moment to review the archives
> > at https://archive.midrange.com/web400.
> >
>
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: [email protected]
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: [email protected]
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.
>
>
-- 
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.