Managing SSL connections to multiple DBSERVERS fro
Does anyone have any firsthand experience using the IBM GSKit for SSL connections? Specifically my issue is how to handle 1 client being able to communicate to multiple Informix servers. I have successfully created the database file and the self signed certificate and successfully connected via onsocssl protocol for a one to one setup, but now I am at a bit of a standstill understanding how I would configure my client to communicate with another Informix server. I tried adding the SERVER.kdb and SERVER.sth to the client and overriding the contents of the conssl.cfg file but that does not seem to work. Informix 11.50.FC3 on AIX 5.3 ML 07 - IBM Global Security Kit (GSKit) version 7.0.4.14. [cid:image002.jpg@01C9911A.9261CCF0]Joe R. Plugge Database Administrator, West Interactive Corporation
For a client to connect to a server, it needs the certificate of the CA= that issued the server's certificate (in the client keystore). Since you're using self-signed certificates, the issuer (or CA) is same= as the owner of the certificate. So for client to connect to server1, we need to extract the server1's certificate and add to client keystore. For client to connect to server2, we need to extract server2's certific= ate and add to client keystore. You can have different certificates for server1 and 2 or you can dupli= cate server1's keys to server2's keystore by using the export/import functionality (Refer to GSKit documentation on exporting and importing keys). Note that we would use self-signed certificates only for testing purpos= es. For production environment, one would request a certificate for their server from a Certificate Authority (CA). In which case, the client will have to add the CA's certificate to its client keystore (rather than doing extract/add we did above for self-signed). Regards, Manoj = "Plugge, Joe R." = <JRPlugge@west.co = m> = To Sent by: ids@iiug.org = ids-bounces@iiug. = cc org = Subj= ect Managing SSL connections to = 02/17/2009 04:13 multiple DBSERVERS.... [14908] = PM = = = Please respond to = ids@iiug.org = = = Does anyone have any firsthand experience using the IBM GSKit for SSL connections? Specifically my issue is how to handle 1 client being able= to communicate to multiple Informix servers. I have successfully created t= he database file and the self signed certificate and successfully connecte= d via onsocssl protocol for a one to one setup, but now I am at a bit of a standstill understanding how I would configure my client to communicate= with another Informix server. I tried adding the SERVER.kdb and SERVER.sth t= o the client and overriding the contents of the conssl.cfg file but that does= not seem to work. Informix 11.50.FC3 on AIX 5.3 ML 07 - IBM Global Security Kit (GSKit) version 7.0.4.14. [cid:image002.jpg@01C9911A.9261CCF0]Joe R. Plugge Database Administrator, West Interactive Corporation ***********************************************************************= ******** Forum Note: Use "Reply" to post a response in the discussion forum. =
Hi Joe, Do you want a single certificate for all servers, since you are doing self signed? Or do you a separate certificate for each server? ________________________________ From: "Plugge, Joe R." <JRPlugge@west.com> To: ids@iiug.org Sent: Tuesday, February 17, 2009 4:13:05 PM Subject: Managing SSL connections to multiple DBSERVERS.... [14908] Does anyone have any firsthand experience using the IBM GSKit for SSL connections? Specifically my issue is how to handle 1 client being able to communicate to multiple Informix servers. I have successfully created the database file and the self signed certificate and successfully connected via onsocssl protocol for a one to one setup, but now I am at a bit of a standstill understanding how I would configure my client to communicate with another Informix server. I tried adding the SERVER..kdb and SERVER.sth to the client and overriding the contents of the conssl.cfg file but that does not seem to work. Informix 11.50.FC3 on AIX 5.3 ML 07 - IBM Global Security Kit (GSKit) version 7.0.4.14. [cid:image002.jpg@01C9911A.9261CCF0]Joe R. Plugge Database Administrator, West Interactive Corporation ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.
Mark, I would like to understand how to do both. Manoj Mohan [manojm@us.ibm.com] replied and I think that his thread has pointed me in the correct direction. Thank you for your reply. Joe -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Mark Jamison Sent: Tuesday, February 17, 2009 9:00 PM To: ids@iiug.org Subject: Re: Managing SSL connections to multiple DBSER.... [14917] Hi Joe, Do you want a single certificate for all servers, since you are doing self signed? Or do you a separate certificate for each server? ________________________________ From: "Plugge, Joe R." <JRPlugge@west.com> To: ids@iiug.org Sent: Tuesday, February 17, 2009 4:13:05 PM Subject: Managing SSL connections to multiple DBSERVERS.... [14908] Does anyone have any firsthand experience using the IBM GSKit for SSL connections? Specifically my issue is how to handle 1 client being able to communicate to multiple Informix servers. I have successfully created the database file and the self signed certificate and successfully connected via onsocssl protocol for a one to one setup, but now I am at a bit of a standstill understanding how I would configure my client to communicate with another Informix server. I tried adding the SERVER..kdb and SERVER.sth to the client and overriding the contents of the conssl.cfg file but that does not seem to work. Informix 11.50.FC3 on AIX 5.3 ML 07 - IBM Global Security Kit (GSKit) version 7.0.4.14. Joe R. Plugge Database Administrator, West Interactive Corporation