We should be coming up pretty soon on TR announcements.

Many people have raised this issue.

As Douglas Adams so famously wrote, "Don't Panic!"

Let's see if there is anything interesting in the next TR.

Are you going to POWERUp 2026 in New Orleans next week?

You can corner Tim Rowe and ask him!

We should be coming up pretty soon on TR announcements.

Many people have raised this issue.

As Douglas Adams so famously wrote, "Don't Panic!"

Let's see if there is anything interesting in the next TR.

Are you going to POWERUp 2026 in New Orleans next week?

You can corner Tim Rowe and ask him!

So the new TRs were finally announced - nothing at all on ACME or certificate renewal automation in the announcement letters. 

Was anything said in Lyon on this topic? Unfortunately I couldn't make it.

We should be coming up pretty soon on TR announcements.

Many people have raised this issue.

As Douglas Adams so famously wrote, "Don't Panic!"

Let's see if there is anything interesting in the next TR.

Are you going to POWERUp 2026 in New Orleans next week?

You can corner Tim Rowe and ask him!

So the new TRs were finally announced - nothing at all on ACME or certificate renewal automation in the announcement letters. 

Was anything said in Lyon on this topic? Unfortunately I couldn't make it.

We should be coming up pretty soon on TR announcements.

Many people have raised this issue.

As Douglas Adams so famously wrote, "Don't Panic!"

Let's see if there is anything interesting in the next TR.

Are you going to POWERUp 2026 in New Orleans next week?

You can corner Tim Rowe and ask him!

We have just gone through a similar exercise with a client who is using GoDaddy, they tried to push a 12 year certificate deal with the 47 day renewal as a reason! We are looking for a solution to fix this for the client, I have also sent a note out to Tim asking for information but not heard back.  I have looked at both certbot and acme.sh, both would need some effort to include the goDaddy to IBM i option (I am sure others will need to be added). I also found the following, which seems to indicate adding certificates to DCM through the web interface will be possible (says new so not sure if this is part of a TR I have not looked at yet?).

https://www.ibm.com/support/pages/new-rest-apis-manage-digital-certificates

We have a monitoring solution that checks for certificate expiry, we would like to build something that can be triggered from this to go out and pull down and install the certificates. Also trying to figure out how to implement the DNS-01 challenge as that seems to be the way to go (lots of information about setting up dummy DNS locally that will skip around needing to update the actual DNS??).  

Please share anything you find, I am sure a lot of customers will be facing this problem very shortly and it was a total surprise to us!

Chris...

------------------------------
Christopher Hird
------------------------------

The REST API for managing certificates were added i march 2024 to the IBM Remote System Explorer for i (ADMIN5 server), however the DCM REST API is lacking an API to renew certificates.
Terry Bartletts is actually using the DCM REST API together with acme.sh, so you can have a look in the source code for examples how to use the DCM REST API.
If I understand the code correctly RitFori stores the certificate to renew in a java keystore instead of DCM.

Jesse Gorzinskis DCM-tools is using cerbot and the traditional DCM API's and using the QycdRenewCertificate API to renew certificates directly from the DCM.

So combining the acme.sh with the DCM API's would be a way forward to automate this. 

Another challenge would be how to handle Certificates for the Integrated Application Server (IAS) and the Integrated Web Services (IWS) as those certificates are not managed from inside DCM. The same goes for the debug service certificate.
Does anyone know how to assign/change them programmatically?

------------------------------
Krister Karlsson
IBM i System Administrator
Crosskey
Stockholm
------------------------------


Original Message:
Sent: Thu April 30, 2026 12:35 PM
From: Christopher Hird
Subject: Automating certificate renewals

We have just gone through a similar exercise with a client who is using GoDaddy, they tried to push a 12 year certificate deal with the 47 day renewal as a reason! We are looking for a solution to fix this for the client, I have also sent a note out to Tim asking for information but not heard back.  I have looked at both certbot and acme.sh, both would need some effort to include the goDaddy to IBM i option (I am sure others will need to be added). I also found the following, which seems to indicate adding certificates to DCM through the web interface will be possible (says new so not sure if this is part of a TR I have not looked at yet?).

https://www.ibm.com/support/pages/new-rest-apis-manage-digital-certificates

We have a monitoring solution that checks for certificate expiry, we would like to build something that can be triggered from this to go out and pull down and install the certificates. Also trying to figure out how to implement the DNS-01 challenge as that seems to be the way to go (lots of information about setting up dummy DNS locally that will skip around needing to update the actual DNS??).  

Please share anything you find, I am sure a lot of customers will be facing this problem very shortly and it was a total surprise to us!

Chris...

------------------------------
Christopher Hird

I am currently in the process of testing and changing RITFORI for use in V7.6 and I will attempt to make it a bit easier to use.

To make it clear RITFORI on Github is a tool which attempts to automate the full TLS certificate process on the IBM i.  It puts the certificate and the Let's Encrypt CAs into both a JKS (Java Key Store) and the DCM if required.

The RSEAPI (ADMIN5) mentioned above requires a full TLS certificate, not a self-signed one, in order to use the DCM APIs.  This chicken and egg makes automation more complicated.  RITFORI sets up a user-id. Then using acme.sh is registers a Let's Encrypt account, creates a TLS certificate and puts in into a JKS.  It uses this certificate for the RSEAPI in order to put the same certificate into the DCM.  It repeats the JKS and DCM process for renewing the certificate.

There are 2 manual steps to be done once, at the moment.  The JKS needs to be added to the ADMIN5 HTTP server and any bespoke DCM applications to be attached to a certficate have to be added manually.

The REST API for managing certificates were added i march 2024 to the IBM Remote System Explorer for i (ADMIN5 server), however the DCM REST API is lacking an API to renew certificates.
Terry Bartletts is actually using the DCM REST API together with acme.sh, so you can have a look in the source code for examples how to use the DCM REST API.
If I understand the code correctly RitFori stores the certificate to renew in a java keystore instead of DCM.

Jesse Gorzinskis DCM-tools is using cerbot and the traditional DCM API's and using the QycdRenewCertificate API to renew certificates directly from the DCM.

So combining the acme.sh with the DCM API's would be a way forward to automate this. 

Another challenge would be how to handle Certificates for the Integrated Application Server (IAS) and the Integrated Web Services (IWS) as those certificates are not managed from inside DCM. The same goes for the debug service certificate.
Does anyone know how to assign/change them programmatically?

------------------------------
Krister Karlsson
IBM i System Administrator
Crosskey
Stockholm


Original Message:
Sent: Thu April 30, 2026 12:35 PM
From: Christopher Hird
Subject: Automating certificate renewals

We have just gone through a similar exercise with a client who is using GoDaddy, they tried to push a 12 year certificate deal with the 47 day renewal as a reason! We are looking for a solution to fix this for the client, I have also sent a note out to Tim asking for information but not heard back.  I have looked at both certbot and acme.sh, both would need some effort to include the goDaddy to IBM i option (I am sure others will need to be added). I also found the following, which seems to indicate adding certificates to DCM through the web interface will be possible (says new so not sure if this is part of a TR I have not looked at yet?).

https://www.ibm.com/support/pages/new-rest-apis-manage-digital-certificates

We have a monitoring solution that checks for certificate expiry, we would like to build something that can be triggered from this to go out and pull down and install the certificates. Also trying to figure out how to implement the DNS-01 challenge as that seems to be the way to go (lots of information about setting up dummy DNS locally that will skip around needing to update the actual DNS??).  

Please share anything you find, I am sure a lot of customers will be facing this problem very shortly and it was a total surprise to us!

Chris...

------------------------------
Christopher Hird

Another problem comes with wild card certificates, from what I read these cannot be automated with acme or certbot? Trying to figure out how to set up the DNS-01 challenge when the DNS could be outside of the providers domain may be a block? When we did the renewal with GoDaddy it was very simple because GoDaddy also had access to the DNS servers to add the TXT entry. Still trying to figure a lot of this stuff out, will be at the 2026 Congress in Lyon so hoping to meet up with Tim and the IBM team there to get some feedback.

I am currently in the process of testing and changing RITFORI for use in V7.6 and I will attempt to make it a bit easier to use.

To make it clear RITFORI on Github is a tool which attempts to automate the full TLS certificate process on the IBM i.  It puts the certificate and the Let's Encrypt CAs into both a JKS (Java Key Store) and the DCM if required.

The RSEAPI (ADMIN5) mentioned above requires a full TLS certificate, not a self-signed one, in order to use the DCM APIs.  This chicken and egg makes automation more complicated.  RITFORI sets up a user-id. Then using acme.sh is registers a Let's Encrypt account, creates a TLS certificate and puts in into a JKS.  It uses this certificate for the RSEAPI in order to put the same certificate into the DCM.  It repeats the JKS and DCM process for renewing the certificate.

There are 2 manual steps to be done once, at the moment.  The JKS needs to be added to the ADMIN5 HTTP server and any bespoke DCM applications to be attached to a certficate have to be added manually.

The REST API for managing certificates were added i march 2024 to the IBM Remote System Explorer for i (ADMIN5 server), however the DCM REST API is lacking an API to renew certificates.
Terry Bartletts is actually using the DCM REST API together with acme.sh, so you can have a look in the source code for examples how to use the DCM REST API.
If I understand the code correctly RitFori stores the certificate to renew in a java keystore instead of DCM.

Jesse Gorzinskis DCM-tools is using cerbot and the traditional DCM API's and using the QycdRenewCertificate API to renew certificates directly from the DCM.

So combining the acme.sh with the DCM API's would be a way forward to automate this. 

Another challenge would be how to handle Certificates for the Integrated Application Server (IAS) and the Integrated Web Services (IWS) as those certificates are not managed from inside DCM. The same goes for the debug service certificate.
Does anyone know how to assign/change them programmatically?

------------------------------
Krister Karlsson
IBM i System Administrator
Crosskey
Stockholm


Original Message:
Sent: Thu April 30, 2026 12:35 PM
From: Christopher Hird
Subject: Automating certificate renewals

We have just gone through a similar exercise with a client who is using GoDaddy, they tried to push a 12 year certificate deal with the 47 day renewal as a reason! We are looking for a solution to fix this for the client, I have also sent a note out to Tim asking for information but not heard back.  I have looked at both certbot and acme.sh, both would need some effort to include the goDaddy to IBM i option (I am sure others will need to be added). I also found the following, which seems to indicate adding certificates to DCM through the web interface will be possible (says new so not sure if this is part of a TR I have not looked at yet?).

https://www.ibm.com/support/pages/new-rest-apis-manage-digital-certificates

We have a monitoring solution that checks for certificate expiry, we would like to build something that can be triggered from this to go out and pull down and install the certificates. Also trying to figure out how to implement the DNS-01 challenge as that seems to be the way to go (lots of information about setting up dummy DNS locally that will skip around needing to update the actual DNS??).  

Please share anything you find, I am sure a lot of customers will be facing this problem very shortly and it was a total surprise to us!

Chris...

------------------------------
Christopher Hird

RITFORI on Github uses Acme which uses a DNS API to automatically add and remove the DNS-01 Challenge TXT record using an API token in the case from Cloudflare. There are nearly 200 DNS providers which Acme supports and have documented, GoDaddy is one of them with limitations. Go to Github https://github.com/acmesh-official/acme.sh/wiki/dnsapi  GoDaddy is number 4, details are further down the page.

Each provider has a different set of requirements for their API. I started with Cloudflare because I had a domain registered with them. Other providers can be added to RITFORI. It may be good to know that Cloudflare will let you use their DNS without charge https://developers.cloudflare.com/dns/faq/  I recommend reading all the details before going for this option.  This means you can use a provider that does not have a DNS01 API.

Acme will also do wild card certificates. I have not yet tested this option.  It is still early days.

I will be at Lyon too.

Another problem comes with wild card certificates, from what I read these cannot be automated with acme or certbot? Trying to figure out how to set up the DNS-01 challenge when the DNS could be outside of the providers domain may be a block? When we did the renewal with GoDaddy it was very simple because GoDaddy also had access to the DNS servers to add the TXT entry. Still trying to figure a lot of this stuff out, will be at the 2026 Congress in Lyon so hoping to meet up with Tim and the IBM team there to get some feedback.

I am currently in the process of testing and changing RITFORI for use in V7.6 and I will attempt to make it a bit easier to use.

To make it clear RITFORI on Github is a tool which attempts to automate the full TLS certificate process on the IBM i.  It puts the certificate and the Let's Encrypt CAs into both a JKS (Java Key Store) and the DCM if required.

The RSEAPI (ADMIN5) mentioned above requires a full TLS certificate, not a self-signed one, in order to use the DCM APIs.  This chicken and egg makes automation more complicated.  RITFORI sets up a user-id. Then using acme.sh is registers a Let's Encrypt account, creates a TLS certificate and puts in into a JKS.  It uses this certificate for the RSEAPI in order to put the same certificate into the DCM.  It repeats the JKS and DCM process for renewing the certificate.

There are 2 manual steps to be done once, at the moment.  The JKS needs to be added to the ADMIN5 HTTP server and any bespoke DCM applications to be attached to a certficate have to be added manually.

The REST API for managing certificates were added i march 2024 to the IBM Remote System Explorer for i (ADMIN5 server), however the DCM REST API is lacking an API to renew certificates.
Terry Bartletts is actually using the DCM REST API together with acme.sh, so you can have a look in the source code for examples how to use the DCM REST API.
If I understand the code correctly RitFori stores the certificate to renew in a java keystore instead of DCM.

Jesse Gorzinskis DCM-tools is using cerbot and the traditional DCM API's and using the QycdRenewCertificate API to renew certificates directly from the DCM.

So combining the acme.sh with the DCM API's would be a way forward to automate this. 

Another challenge would be how to handle Certificates for the Integrated Application Server (IAS) and the Integrated Web Services (IWS) as those certificates are not managed from inside DCM. The same goes for the debug service certificate.
Does anyone know how to assign/change them programmatically?

------------------------------
Krister Karlsson
IBM i System Administrator
Crosskey
Stockholm


Original Message:
Sent: Thu April 30, 2026 12:35 PM
From: Christopher Hird
Subject: Automating certificate renewals

We have just gone through a similar exercise with a client who is using GoDaddy, they tried to push a 12 year certificate deal with the 47 day renewal as a reason! We are looking for a solution to fix this for the client, I have also sent a note out to Tim asking for information but not heard back.  I have looked at both certbot and acme.sh, both would need some effort to include the goDaddy to IBM i option (I am sure others will need to be added). I also found the following, which seems to indicate adding certificates to DCM through the web interface will be possible (says new so not sure if this is part of a TR I have not looked at yet?).

https://www.ibm.com/support/pages/new-rest-apis-manage-digital-certificates

We have a monitoring solution that checks for certificate expiry, we would like to build something that can be triggered from this to go out and pull down and install the certificates. Also trying to figure out how to implement the DNS-01 challenge as that seems to be the way to go (lots of information about setting up dummy DNS locally that will skip around needing to update the actual DNS??).  

Please share anything you find, I am sure a lot of customers will be facing this problem very shortly and it was a total surprise to us!

Chris...

------------------------------
Christopher Hird

RITFORI on Github uses Acme which uses a DNS API to automatically add and remove the DNS-01 Challenge TXT record using an API token in the case from Cloudflare. There are nearly 200 DNS providers which Acme supports and have documented, GoDaddy is one of them with limitations. Go to Github https://github.com/acmesh-official/acme.sh/wiki/dnsapi  GoDaddy is number 4, details are further down the page.

Each provider has a different set of requirements for their API. I started with Cloudflare because I had a domain registered with them. Other providers can be added to RITFORI. It may be good to know that Cloudflare will let you use their DNS without charge https://developers.cloudflare.com/dns/faq/  I recommend reading all the details before going for this option.  This means you can use a provider that does not have a DNS01 API.

Acme will also do wild card certificates. I have not yet tested this option.  It is still early days.

I will be at Lyon too.

Another problem comes with wild card certificates, from what I read these cannot be automated with acme or certbot? Trying to figure out how to set up the DNS-01 challenge when the DNS could be outside of the providers domain may be a block? When we did the renewal with GoDaddy it was very simple because GoDaddy also had access to the DNS servers to add the TXT entry. Still trying to figure a lot of this stuff out, will be at the 2026 Congress in Lyon so hoping to meet up with Tim and the IBM team there to get some feedback.

I am currently in the process of testing and changing RITFORI for use in V7.6 and I will attempt to make it a bit easier to use.

To make it clear RITFORI on Github is a tool which attempts to automate the full TLS certificate process on the IBM i.  It puts the certificate and the Let's Encrypt CAs into both a JKS (Java Key Store) and the DCM if required.

The RSEAPI (ADMIN5) mentioned above requires a full TLS certificate, not a self-signed one, in order to use the DCM APIs.  This chicken and egg makes automation more complicated.  RITFORI sets up a user-id. Then using acme.sh is registers a Let's Encrypt account, creates a TLS certificate and puts in into a JKS.  It uses this certificate for the RSEAPI in order to put the same certificate into the DCM.  It repeats the JKS and DCM process for renewing the certificate.

There are 2 manual steps to be done once, at the moment.  The JKS needs to be added to the ADMIN5 HTTP server and any bespoke DCM applications to be attached to a certficate have to be added manually.

The REST API for managing certificates were added i march 2024 to the IBM Remote System Explorer for i (ADMIN5 server), however the DCM REST API is lacking an API to renew certificates.
Terry Bartletts is actually using the DCM REST API together with acme.sh, so you can have a look in the source code for examples how to use the DCM REST API.
If I understand the code correctly RitFori stores the certificate to renew in a java keystore instead of DCM.

Jesse Gorzinskis DCM-tools is using cerbot and the traditional DCM API's and using the QycdRenewCertificate API to renew certificates directly from the DCM.

So combining the acme.sh with the DCM API's would be a way forward to automate this. 

Another challenge would be how to handle Certificates for the Integrated Application Server (IAS) and the Integrated Web Services (IWS) as those certificates are not managed from inside DCM. The same goes for the debug service certificate.
Does anyone know how to assign/change them programmatically?

------------------------------
Krister Karlsson
IBM i System Administrator
Crosskey
Stockholm


Original Message:
Sent: Thu April 30, 2026 12:35 PM
From: Christopher Hird
Subject: Automating certificate renewals

We have just gone through a similar exercise with a client who is using GoDaddy, they tried to push a 12 year certificate deal with the 47 day renewal as a reason! We are looking for a solution to fix this for the client, I have also sent a note out to Tim asking for information but not heard back.  I have looked at both certbot and acme.sh, both would need some effort to include the goDaddy to IBM i option (I am sure others will need to be added). I also found the following, which seems to indicate adding certificates to DCM through the web interface will be possible (says new so not sure if this is part of a TR I have not looked at yet?).

https://www.ibm.com/support/pages/new-rest-apis-manage-digital-certificates

We have a monitoring solution that checks for certificate expiry, we would like to build something that can be triggered from this to go out and pull down and install the certificates. Also trying to figure out how to implement the DNS-01 challenge as that seems to be the way to go (lots of information about setting up dummy DNS locally that will skip around needing to update the actual DNS??).  

Please share anything you find, I am sure a lot of customers will be facing this problem very shortly and it was a total surprise to us!

Chris...

------------------------------
Christopher Hird