Installing the Informix encryption certificate on your Windows computer

Last Updated : Sep 25, 2024 |
Prolog information
Metadata
Keywords:
Install the Informix encryption certificate from the CMS server on the computer where the ODBC and JDBC client software is installed. The client certificate must match the certificate on CMS. Perform this procedure when TLS/SSL encryption is enabled on the CMS server.
Before you begin
  • Run the ids_tls_configure -e command to confirm that TLS/SSL encryption is enabled on the CMS server. To confirm that the TLS/SSL encryption certificate is updated, run the ids_tls_configure -u command.
  • Ensure that the Informix Client SDK is installed on your computer.
  • Create an Informix JKS keystore password if you do not already have one. Remember this password in case you need to update the certificate in the future.
  1. Log in to Windows as an administrator.
  2. Use WinSCP or a similar tool to copy the SSL certificate files from the CMS server to your computer.
    ADDITIONAL INFORMATION:
    The SSL certificates are in the /opt/informix/ssl directory on the CMS server.
    ADDITIONAL INFORMATION:
    The following is an example of the naming convention used if additional root and intermediate certificates exist:
    • HOSTNAME_cert1.pem
    • HOSTNAME_cert2.pem
    • HOSTNAME_cms_net_encrypt.pem
  3. Create a folder on your computer for the Informix TLS/SSL keystore for JDBC access.
    ADDITIONAL INFORMATION:
    For example, you can create the folder in the C:\Program Files\HCL Informix Client SDK\ssl directory.
  4. Create the conssl.cfg file in the C:\Program Files\HCL Informix Client SDK\etc\ directory.
  5. Insert the following lines into the file:
    ADDITIONAL INFORMATION: SSL_KEYSTORE_FILE <KeystorePath>\cms_ol.p12
    SSL_KEYSTORE_STH <KeystorePath>\cms_ol.sth
    ADDITIONAL INFORMATION:
    <KeystorePath> is the folder you created in step 3.
    Do not use spaces in the path. Instead, use a shortened path name. Do not add single or double quotes around the path.
  6. Save and close the file.
  7. Open the Windows command line interface.
  8. Navigate to the <KeystorePath> folder created in step 3.
  9. Run the following command:
    ADDITIONAL INFORMATION: gsk8capicmd_64 -keydb -create -db cms_ol.p12 -pw <KS_PASSWORD> -stash
    ADDITIONAL INFORMATION:
    In this command, <KS_PASSWORD> is the password for the JKS keystore.
  10. Run the following command for each SSL certificate file:
    ADDITIONAL INFORMATION: gsk8capicmd_64 -cert -add -db cms_ol.p12 -stash -label cms_net_encrypt -file <SSL_CERT_FILE> -format ascii -trust enable
  11. To create a keystore and add certificates for JDBC, run the following command for each SSL certificate file:
    ADDITIONAL INFORMATION: keytool -importcert -file <SSL_CERT_FILE> -alias <ALIAS> -keystore cms_ol.ks -storepass <KS_PASSWORD>
    ADDITIONAL INFORMATION:
    In this command, <SSL_CERT_FILE> is the SSL certificate file, <ALIAS> is the portion of the certificate file name after the first underscore, and <KS_PASSWORD> is the password for the JKS keystore. For example, if the certificate file name is HOSTNAME_cms_net_encrypt.pem, then cms_net_encrypt is the alias portion.
    ADDITIONAL INFORMATION:
    Tip:
    You can find keytool in the Java directory. Use the full path to run keytool. For example:
    C:\Program Files\Java\jre1.8.0_172\bin\keytool.exe -importcert -file <SSL_CERT_FILE> -keystore cms_ol.ks
  12. Enter yes when prompted to trust this certificate.
  13. Do the following to verify the keystore file permissions:
    1. In Windows Explorer, navigate to the keystore folder.
    2. Right-click the cms_ol.p12 and cms_ol.sth files, and click Properties.
    3. Verify that any users who will run ODBC connections at least have Read permissions.
  14. Do the following to update the ODBC data source protocol:
    1. From Control Panel, navigate to Set up ODBC Data sources (32-bit) or Set up ODBC Data sources (64-bit) as appropriate for your version of Windows.
      STEP RESULT:
      The ODBC Data Source Administrator window is dispalyed.
    2. Click the System DSN tab.
    3. Select the ODBC data source from the list.
    4. Click Configure.
    5. Click the Connection tab.
    6. In the Protocol list, select olsocssl.
    7. Click Apply.
  15. Do the following to configure a TLS/SSL connection to the database from your Java application:
    1. Set the javax.net.ssl.truststore system property to point to the keystore that you created.
      ADDITIONAL INFORMATION:
      For example:
      javax.net.ssl.trustStore=<KeystorePath>/cms_ol.ks
    2. Set the javax.net.ssl.trustStorePassword system property to the password that you used for the certificate.
      ADDITIONAL INFORMATION:
      For example:
      javax.net.ssl.trustStorePassword=<KS_PASSWORD>
    3. Set a data source object.
    4. Set the port number to the SSL port 50000.
    5. Set the setIfxSSLCONNECTION data source property to true.