RE: LDAP Key Store Password and GSK7capicmd Password

The way Marcel says in your other question. The CA cert just needs to be in
the keystore as a "root" or "signer" certificate.

Frank - from my phone
On Mar 21, 2013 7:24 AM, "Gregory Mendes" <[email protected]>
wrote:

>  Hey Frank,
>
> Thanks alot for that great information.  My question is how do I use that
> .cer Public key as the certificate that the hub_TEMS will use for user
> authentication?  Is that possible?
>
>
> Regards,
>
> Gregory R. Mendes
> 770-317-8593
>
>
> ------------------------------
> Date: Wed, 20 Mar 2013 23:52:32 -0400
> Subject: RE: [TME10] LDAP Key Store Password and GSK7capicmd Password
> From: frank.tate-9LkaxTQlAnxWk0Htik3J/[email protected]
> To: [email protected]
>
> You can't make a .cer certificate the default because it's NOT  a PRIVATE
> certificate (which is what the error is telling you). That .cer file is
> normally the public key for the CA (so clients can verify that the CA
> signed a certificate). An actual PRIVATE key/certificate will almost always
> be in a .pks file (or similar) and will have a password that's needed to
> import or read it (the .cer file does not require a password because it's a
> PUBLIC certificate). You can have multiple CA public certs in a keystore,
> and that has the effect that any one of those CAs is "trusted" to sign
> certificates that are either atored in this keystore or received by the
> client that is using this keystore. You can also (separately) have multiple
> personal (private) certs in the keystore that can be presented by the
> client rhat is using this keyatore. To tell the client exactly which
> personal/private key to present, tou have to specify the label of that
> certificate as it appears in the keystore. But tou just about NEVER have to
> specify the label of any CA certificate.
>
> I realize it's confusing, but that's just how it is. You may need to do
> some generic research on SSL, certificates and keystores before you ever
> try to get LDAP involved, since that adsitional layer REQUIRES a REALLY
> firm understanding of PKI.
>
> Frank - from my phone
> On Mar 20, 2013 8:35 PM, "Gregory Mendes" <[email protected]>
> wrote:
>
>  Hey Toben,
>
> Here's the problem.  By default the configuration for LDAP at the hub_TEMS
> creates a CA called IBM_Tivoli_Monitoring_Certificate that is set to the
> default private key CA (!-*).  When I import the CA certificate that the
> customer wants to use, it's listed in the keyfile.kdb but I can make it the
> default.  It give me the error GSKKM_ERR_KEYREC_PRIVATE_KEY_NULL when
> trying to run the gsk7capicmd -cert -setdefault  -db
> /opt/IBM/ITM/keyfiles/keyfile.kdb -label "goes CA".  It's really making me
> want to shoot a round through the screen.  :)
>
> Regards,
>
> Gregory R. Mendes
> Tivoli Architect/Tools Specialist
> Mendes, Inc.
> Tivoli Monitoring 6.2.3 Certified
> 770-317-8593
>
>
> ------------------------------
> Date: Wed, 20 Mar 2013 18:32:40 -0500
> Subject: Re: [TME10] LDAP Key Store Password and GSK7capicmd Password
> From: [email protected]
> To: [email protected]
>
> Private keys, keystores, password encryption of said keystores and/or
> keys: all interchangable relative to OS.  But I hear you, not apt in the
> perfect sense for Linux
> On Mar 20, 2013 4:34 PM, "[email protected]" <
> [email protected]> wrote:
>
> So if you are talking about creating a new keystore, then you can give it
> any password you want and that password has nothing to do with SSL
> encryption at all--it just serves as your credential to open the keystore
> database (*.kdb) file.  Once you have a keystore database opened, you can
> then import/export certificates of types both "personal" and "signer"
> to/from it.  Sometimes these certificates themselves were password
> protected when they were exported, and so to import them into your keystore
> you'll need to have the password used when they were exported.
>
> I know that isn't an explicit answer to the error you're seeing below, but
> I'm just providing enough info to get moving in a progressive direction.
> Also, the attached file, while germane on its surface to MS's IE, has some
> good info int he 7 sections at the beginning that can shed some light on
> the relationships and concepts here.
>
> Toben
>
> On Wed, Mar 20, 2013 at 2:07 PM, Gregory Mendes <
> [email protected]> wrote:
>
>  Hello All,
>
> Are these two passwords the same?
>
> So, when I configure the h_tems for LDAP support it asks me for LDAP Key
> store and I give it a password.  Should this password be the IBM61TIV or
> can you make it anything?  Or, does this password need to be the same for
> both the LDAP configuration and the CA certificate install to the
> keyfile.kdb?
>
> I get this error in my TEMS logfile:
>
> LDAP client is Success.
> LDAP SSL initialization (113), SSL failure reason code (102):
> LDP1_Keyring /opt/IBM/ITM/keyfiles, password xxxxxxxx.
>
> Any ideas?
>
> Regards,
>
> Gregory R. Mendes
> Tivoli Architect/Tools Specialist
> Mendes, Inc.
> Tivoli Monitoring 6.2.3 Certified
> 770-317-8593
>
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>
>
>
> --
> "Sometimes I think that's the only right thing to do:
> To dream. to live in the world of dreams.
> But it doesn't last forever--wakefulness always comes to take me back..."
>
>
> _______________________________________________ TME10 mailing list
> [email protected] Unsubscribe:[email protected]
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>
> _______________________________________________ TME10 mailing list
> [email protected] Unsubscribe:[email protected]
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>

_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]