IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009 - 39

The SSL protocol provides transport-layer security with authenticity, integrity and conﬁdentiality for a secure connection between a client and server. 2. Create a local certificate authority (CA). 3. Create a locally signed system certificate within Digital Certificate Manager (DCM). s %NABLE 33, WITHIN THE 73%26)#% (440 !PACHE SERVER INSIDE THE )"- 7EB !DMINISTRATION '5) s 7ITHIN $#- ASSIGN A SYSTEM CERTIFICATE TO THE APPLICATION )$ ASSIGNED TO THE 73%26)#% (440 SERVER .OTE& 7EÇLL ASSUME THE USE OF A LOCALLY CREATED SYSTEM CERTIFICATE )F A CERTIFICATE FROM A WELLKNOWN CERTIFICATE AUTHORITY IS NEEDED PLEASE REFER TO h-ANAGING PUBLIC )NTERNET CERTIFICATES FOR 33, COMMUNICATIONS SESSIONSv IN THE )"- )NFORMATION #ENTER ÈHTTP&PUBLIBBOULDERIBMCOMINFOCENTERSYSTEMS SCOPEI!OSTOPICRZAHURZAHURZAHU #COMPLETENEWSTORE HTM1TOCNODE)INT?##%É #LICK h#REATE A #ERTIFICATE !UTHORITY È#!Év ON THE LEFTHAND MENU BAR 9OUÇLL BE PRESENTED WITH THE #REATE A #ERTIFICATE Authority (CA) form. Fill it out as follows: @Znh^oZ/ +EEP THE DEFAULT OF  8Zgi^[^XViZhidgZeVhhldgY/ 3ET A PASSWORD FOR THE CERTIFICATE authority store 8dc[^gbeVhhldgY/ #ONFIRM THE PASSWORD 8Zgi^[^XViZVji]dg^in86cVbZ/ 4HIS IS THE NAME OF THE CERTIFICATE AUTHORITY THAT WILL SIGN CERTIFICATES ÈEG )"- 4EST certificate authority) Dg\Vc^oVi^dccVbZ/ 9OUR ORGANIZATION NAME ÈEG )"-É HiViZdgegdk^cXZ/ 9OUR STATE OR PROVINCE NAME MUST CONTAIN AT LEAST THREE CHARACTERS ÈEG -).É 8djcigndggZ\^dc/ EG 53 KVa^Y^in eZg^dY d[ 8Zgi^[^XViZ 6ji]dg^in 86 '",(%%/ 5SUALLY THIS IS SET TO # TO MAKE THE CERTIFICATE LAST AS LONG AS POSSIBLE WITHOUT RENEWAL #LICK h#ONTINUEv 4HE NEXT SCREEN OPTION LETS YOU INSTALL THE CERTIFICATE AUTHORITY CERTIFICATE INTO THE BROWSER SO IT WILL TRUST THE CERTIFICATE AUTHORITY &EEL FREE TO DO THIS IF YOUÇD LIKE BUT ITÇS NOT REQUIRED #LICK h#ONTINUEv /N THE NEXT SCREEN YOU SHOULD SEE THE #ERTIFICATE !UTHORITY È#! 0OLICY $ATAÉ FORM WITH THE FOLLOWING PARAMETERS& Creating Certiﬁcates in the DCM 4O ACCESS THE $#- FIRST ENSURE THAT THE (440 !$-). SERVER IS UP& STRTCPSVR SERVER(*HTTP) HTTPSVR(*ADMIN) 4HEN BRING UP A 7EB BROWSER AND ACCESS THE '5) USING THE ADDRESS HTTP&SYSTEMNAME& ÈREPLACING hSYSTEMNAMEv WITH THE NAME OR )0 ADDRESS OF YOUR )"- I SYSTEMÉ 9OU SHOULD SEE A TASK SCREEN WITH A $IGITAL #ERTIFICATE -ANAGER OPTION 4O BYPASS THE INITIAL SIGNON SCREEN AND GO DIRECTLY TO $#- USE 52, HTTP&SYSTEMNAME&1)"- )#33#ERT!DMINQYCUCMNDMMAIN &ROM THE $#- SCREEN È&IGURE  RIGHTÉ CLICK h3ELECT A #ERTIFICATE 3TOREv TO DETERMINE WHAT NEEDS TO BE CREATED )F YOUR SCREEN OPTION IS h/THER 3YSTEM #ERTIFICATE 3TOREv CONTINUE READING 0ART  ÈBELOWÉ )F YOUR SCREEN OPTIONS ARE h3934%-v AND h/THER 3YSTEM #ERTIFICATE 3TOREv SKIP TO 0ART  ÈPAGE É )F YOUR SCREEN OPTIONS ALSO INCLUDE h,OCAL #ERTIFICATE !UTHORITYv SKIP TO 0ART  ÈPAGE É Figure 1 Creating Certiﬁcates, Part 1 4HE OPTIONS IN h3ELECT A #ERTIFICATE 3TOREv SHOW THAT A LOCAL CERTIFICATE AUTHORITY STORE AND A 3934%- STORE ARE MISSING AND NEED TO BE CREATED &ORTUNATELY THE $#WIZARD LETS US CREATE A #! CERTIFICATE A 3934%- STORE AND A LOCALLY SIGNED SER VER CERTIF ICATE IN THE STORE ALL FROM ONE WIZARD JANUARY 2009 ibmsystemsmag.com 39

http://publib.boulder.ibm.com/infocenter/systems/scope/i5os/topic/rzahu/rzahurzahu437completenewstore.htm?tocnode=int_227379 http://publib.boulder.ibm.com/infocenter/systems/scope/i5os/topic/rzahu/rzahurzahu437completenewstore.htm?tocnode=int_227379 http://publib.boulder.ibm.com/infocenter/systems/scope/i5os/topic/rzahu/rzahurzahu437completenewstore.htm?tocnode=int_227379 http://www.ibmsystemsmag.com

IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009

Table of Contents for the Digital Edition of IBM Systems Magazine, Power Systems --- IBM i digital edition, January 2009