Introduction

IBM Db2 Genius Hub is deployed with HTTPS enabled by default, utilizing an automatically generated self-signed certificate created during installation. Although this configuration is adequate for development and testing purposes, it is not typically recommended for production environments, where certificates issued by a trusted Certificate Authority (CA) are preferred to ensure stronger security and trust.

In this blog, you’ll also learn how to seamlessly replace the default certificate in IBM Db2 Genius Hub with your own custom SSL certificate.

Default Configuration

By default, IBM Db2 Genius Hub is configured to run on the following ports:

• HTTP Port: 11100
• HTTPS Port: 11101

You can modify these ports in the configuration file:

ibm-db2GeniusHub/wlp/usr/servers/dsweb/bootstrap.properties

The installation also includes a default keystore (key.p12) that is used to enable HTTPS communication. In this guide, you will learn how to replace this default keystore with your own custom certificate.

Prerequisites

Before you begin, ensure you have the following:

• Administrative access to the IBM Db2 Genius Hub server
• A certificate in .p12 format (either CA-signed or self-signed)

Note: If your certificate is not already in .p12 format, you may need to convert it before proceeding. If you already have a .p12 certificate, you can skip the certificate generation steps and proceed directly to Step 4.

Step-by-Step Guide

Step 1: Locate the Installation Directory

Start by logging into your server and navigating to the Db2 Genius Hub installation directory:

[db2gh-user@db2gh-console ~]$ cd ibm-db2GeniusHub
[db2gh-user@db2gh-console ibm-db2GeniusHub]$ pwd
/home/db2gh-user/ibm-db2GeniusHub

Now you’re at the root of the Db2 Genius Hub installation.

Step 2: Go to the Security Directory

From the installation root, navigate to the directory where the default keystore is stored:

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ cd wlp/usr/servers/dsweb/resources/security/

[db2gh-user@db2gh-console security]$ pwd
/home/db2gh-user/ibm-db2GeniusHub/wlp/usr/servers/dsweb/resources/security/

[db2gh-user@db2gh-console security]$ ls
key.p12  ltpa.keys

The key.p12 file you see here is the default keystore used for HTTPS.

Back up the existing key.p12 file before making any changes.

Step 3: Add Your Custom Certificate

At this point, you can either generate a new self-signed certificate or use an existing .p12 file.

Option A: Generate a Self-Signed Certificate

Generate the certificate and key:

[db2gh-user@db2gh-console security]$ pwd
/home/db2gh-user/ibm-db2GeniusHub/wlp/usr/servers/dsweb/resources/security/

[db2gh-user@db2gh-console security]$ openssl req -newkey rsa:2048 -nodes -keyout custom_key.pem -x509 -days 365 -out custom_certificate.pem

Fill in the details when prompted:

Country Name (2 letter code): IN
State or Province Name: KERALA
Locality Name: KOCHI
Organization Name: IBM
Organizational Unit Name: DGH
Common Name: dgh.example.com

Make sure the Common Name (CN) matches your server hostname.

Convert it to .p12:

[db2gh-user@db2gh-console security]$ pwd
/home/db2gh-user/ibm-db2GeniusHub/wlp/usr/servers/dsweb/resources/security/

[db2gh-user@db2gh-console security]$ openssl pkcs12 -export -in custom_certificate.pem -inkey custom_key.pem -out custom_certificate.p12

Enter Export Password: <user entered password>

Keep this password handy—you’ll need it next.

Option B: Use an Existing Certificate

If you already have a .p12 file, just copy it into this directory:

[db2gh-user@db2gh-console security]$ pwd
/home/db2gh-user/ibm-db2GeniusHub/wlp/usr/servers/dsweb/resources/security/

[db2gh-user@db2gh-console security]$ cp /path/to/custom_certificate.p12 .
[db2gh-user@db2gh-console security]$ ls
custom_certificate.p12  key.p12  ltpa.keys

Make a note of the certificate password and move on.

Step 4: Encrypt the Certificate Password

Before updating the configuration, the certificate password needs to be encrypted.

On Linux

From the installation root:

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ pwd
/home/db2gh-user/ibm-db2GeniusHub

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ ./dsutil/bin/libertyCertsCrypt.sh <user entered password>

On Windows

C:\> cd <dghhome>\dsutil\bin
C:\dghhome\dsutil\bin> libertyCertsCrypt.bat <user entered password>

Enter the password directly (no < >, no quotes), and copy the encrypted output—you’ll use it next.

Step 5: Update the Configuration

Back up the existing bootstrap.properties file before making any changes.

Now update the keystore settings.

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ pwd
/home/db2gh-user/ibm-db2GeniusHub

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ vi wlp/usr/servers/dsweb/bootstrap.properties

Update the following lines:

wlp.keystore.location=custom_certificate.p12
wlp.keystore.password=<Add the previously created encrypted certificate password here>

Save and exit the file.

Step 6: Restart the Service

Apply the changes by restarting Db2 Genius Hub:

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ pwd
/home/db2gh-user/ibm-db2GeniusHub

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ cd bin/
[db2gh-user@db2gh-console bin]$ ./restart.sh

Give it a moment to come back up.

Step 7: Verify HTTPS Access

Now open your browser and visit:

https://your-server-hostname:11101

• If you used a CA-signed certificate, the connection should be trusted with no warnings
• If you used a self-signed certificate, the browser may display a security warning. Before proceeding, verify that the certificate details (such as the issuer, subject, and fingerprint) match the certificate you expect. If the details are correct, you can safely accept the certificate and continue.

Troubleshooting

Issue: Service Won't Start

Check the logs:

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ pwd
/home/db2gh-user/ibm-db2GeniusHub

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ cd logs

[db2gh-user@db2gh-console ibm-db2GeniusHub]$ tail -f messages.log

Common causes:

• Incorrect file path in bootstrap.properties
• Wrong encrypted password
• Certificate file permissions issues

Issue: Invalid Password Error

Solution:

• Ensure you didn't include single quotes when encrypting the password
• Re-encrypt the password using the correct format: <user entered password> (without quotes or angle brackets)
• Verify the password in bootstrap.properties matches the encrypted output

Issue: Certificate Not Recognized

Solution:

• Verify the certificate file is in .p12 format
• Check that the Common Name in the certificate matches your server hostname
• Ensure the certificate hasn't expired

Best Practices

1. Backup First: Always backup the existing key.p12 and bootstrap.properties before making changes
2. Use Strong Passwords: Choose a strong password for your certificate export
3. Secure Storage: Keep your certificate files and passwords secure
4. Monitor Expiration: Set reminders to renew certificates before they expire (typically 1-2 years)
5. Test Environment: Test certificate changes in a non-production environment first
6. Document Changes: Keep records of certificate details and renewal dates

Certificate Renewal

When your certificate expires, follow these steps:

1. Obtain a new certificate (either generate a new self-signed one or get a new CA-signed certificate)
2. Follow Steps 2-7 above with the new certificate
3. The configuration file doesn't need changes if you use the same filename and password

Summary

Replacing the default certificate in Db2 Genius Hub is straightforward:

1. Navigate to the security directory
2. Generate or place your custom .p12 certificate
3. Encrypt the certificate password
4. Update bootstrap.properties with the certificate name and encrypted password
5. Restart Db2 Genius Hub

Your Db2 Genius Hub is now secured with your custom SSL certificate!

Note: The examples mentioned are tried on particular OS <i.e. RHEL 9/SuSe/Ubuntu>, it might vary little across different platforms.

Additional Resources

• Official IBM Documentation: Enabling HTTPS for Db2 Genius Hub
• Modifying Db2 Genius Hub Ports
• OpenSSL Documentation