Updating the Informix encryption certificate on a Windows computer

Last Updated : Sep 26, 2024 |
Prolog information
Metadata
Keywords:
When TLS/SSL encryption is updated, perform this procedure on the computer where the ODBC and JDBC client software is installed. You can use one of the following command options to update TLS/SSL encryption on the CMS server:
  • Run ids_tls_configure -u to perform the update directly.
  • Run ids_tls_configure -r followed by ids_tls_configure -e to remove and re-enable encryption.
Before you begin
  • Ensure that the lnformix Client SDK is installed on your computer.
  • You need the path to the Informix TLS/SSL keystore for JDBC access.
  • Ensure that you have the keystore password you used when installing the encryption certificate on your computer.
  1. Use WinSCP or a similar tool to copy the SSL certificate files from the CMS server to your computer.
    ADDITIONAL INFORMATION:
    The SSL certificates are in the /opt/informix/ssl directory on the CMS server.
    The following is an example of the naming convention used if additional root and intermediate certificates exist:
    • HOSTNAME_cert1.pem
    • HOSTNAME_cert2.pem
    • HOSTNAME_cms_net_encrypt.pem
  2. Open the Windows command line interface.
  3. From the folder where the Informix TLS/SSL keystore is located, run gsk8capicmd_64 -cert -list all -db cms_ol.p12 -stash to view the configured certificates.
    ADDITIONAL INFORMATION:
    For example, run the following command based on the keystore location:
    C:\Program Files\HCL Informix ClientSDK\ssl>
    gsk8capicmd_64 -cert -list all -db cms_ol.p12 -stash
    The following is an example of the output displayed:
    Certificates found
    * default, - personal, ! trusted, # secret key
    ! "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US"
    ! "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US"
    - cms_net_encrypt
    ADDITIONAL INFORMATION:
    The certificate alias is under the *default line.
  4. Run the following command for each certificate:
    ADDITIONAL INFORMATION: gsk8capicmd_64 -cert -delete -db cms_ol.p12 -stash -label <CERT_ALIAS>
    <CERT_ALIAS> is the certificate alias identified in the previous step.
  5. Run the following command to view the certificates in the JDBC keystore:
    ADDITIONAL INFORMATION: keytool -list -keystore cms_ol.ks -storepass <KS_PASSWORD>
    <KS_PASSWORD> is the password for the keystore.
    Tip:
    You can find keytool in the Java directory. Use the full path to run keytool. For example:
    C:\Program Files\Java\jre1.8.0_172\bin\keytool.exe -importcert 
    -file <SSL_CERT_FILE> -keystore cms_ol.ks
  6. From the command output, determine the alias for the configured certificates.
    ADDITIONAL INFORMATION:
    The alias is the first part of each certificate line indicated by a date value. For example:
    Keystore type: PKCS12
    Keystore provider: SUN

    Your keystore contains 3 entries

    cert1, Oct 23, 2020, trustedCertEntry,
    Certificate fingerprint (SHA-256):
    15:4C:43:3C:49:19:29:C5:EF:68:6E:83:8E:32:36:64:A0:0E:6A:0D:82:2C:CC:95:8F:B4:DA:B0:3
    E:49:A0:8F

    cert2, Oct 23, 2020, trustedCertEntry,
    Certificate fingerprint (SHA-256):
    43:48:A0:E9:44:4C:78:CB:26:5E:05:8D:5E:89:44:B4:D8:4F:96:62:BD:26:DB:25:7F:89:34:A4:4
    3:C7:01:61

    cms_net_encrypt, Oct 23, 2020, trustedCertEntry,
    Certificate fingerprint (SHA-256):
    75:F4:E8:73:CE:EF:3C:B6:E3:0A:6F:76:2E:1B:71:C2:3B:C6:2B:75:8B:60:81:3F:D8:73:06:29:E
    6:6C:63:DB
  7. Run the following command for each certificate:
    ADDITIONAL INFORMATION: keytool -delete -noprompt -alias <CERT_ALIAS> -keystore cms_ol.ks -storepass
    <KS_PASSWORD>
    ADDITIONAL INFORMATION:
    <CERT_ALIAS> represents the aliases listed in the example above.
  8. Run the following commands for each PEM certificate file copied from the CMS server:
    ADDITIONAL INFORMATION: gsk8capicmd_64 -cert -add -db cms_ol.p12 -stash -label
    cms_net_encrypt -file <SSL_CERT_FILE> -format ascii -trust enable    keytool -importcert -file <SSL_CERT_FILE> -alias <ALIAS>
    -keystore cms_ol.ks -storepass <KS_PASSWORD>
    The alias is the portion of the SSL certificate file name after the first underscore. For example, if the certificate file name is HOSTNAME_cms_net_encrypt.pem, then the alias portion is cms_net_encrypt.
  9. If you are prompted to trust the certificate, enter yes.