IBM i Global

IBM i 

A space for professionals working with IBM’s integrated OS for Power systems to exchange ideas, ask questions, and share expertise on topics like RPG and COBOL development, application modernization, open source integration, system administration, and business continuity.


#Power


#IBMi
#Power
#Operatingsystems
#Servers
 View Only

  • 1.  IBM i DCM - Last Use Timestamp for each certificate

    Posted 09/18/23 01:29 AM

    I have submitted a proposal for an enhancement to IBM i DCM to add a Last Use Timestamp (and Use Count) to every certificate in the store to help system admin with housekeeping decision.   For those who also need this proposed idea, please help cast your votes for my proposal here:  https://ideas.ibm.com/ideas/IBMI-I-3786

    Thanks.



    ------------------------------
    Chance favors only the prepared mind.
    -- Louis Pasteur
    ------------------------------
    Satid S.
    ------------------------------


  • 2.  RE: IBM i DCM - Last Use Timestamp for each certificate

    Posted 09/19/23 01:42 AM
    Edited by Jozsef Torok 09/19/23 01:46 AM

    Hi Satid, 

    I like the idea, and have voted. 

    By coincidence I have very recently been doing quite a bit of certificate work that led to running an audit of TLS connections that includes a running count of TLS connections. This is via the SST Advanced Analysis command TLSCONFIG, and setting the required options in the QAUDLVL system value.

    Also came up with a process where we can identify the certificate used by a specific TLS connection using the TRCCNN command and analysing the output using Wireshark. This was more a case of being curious that after a certificate change that the subsequent TLS connections were using the correct (new) certificate. 

    If this is something you may be interested in I can send more details later.

    Regards,

    Jozsef. 





  • 3.  RE: IBM i DCM - Last Use Timestamp for each certificate

    Posted 09/19/23 10:50 PM

    Dear Jozsef

    >>>>> Also came up with a process where we can identify the certificate used by a specific TLS connection using the TRCCNN command and analysing the output using Wireshark. <<<<<

    I'm interested in learning how to do this.  Please help post the information when you have free time. 

    Thanks. 



    ------------------------------
    Chance favors only the prepared mind.
    -- Louis Pasteur
    ------------------------------
    Satid S.
    ------------------------------

    Original Message


  • 4.  RE: IBM i DCM - Last Use Timestamp for each certificate

    Posted 09/20/23 05:19 AM

    to help lookinto certs maybe the code mentioned here would help
    3 CL Commands to Manage Digital Certificates – Articles on Apis (wordpress.com)

    i've also used some of the ssl commands available in the IBM i open source RPMs.

    Google can help find the syntax for those commands.



    ------------------------------
    Bryan Dietz
    ------------------------------

    Original Message


  • 5.  RE: IBM i DCM - Last Use Timestamp for each certificate

    Posted 09/20/23 07:39 AM

    See also:  https://www.ibm.com/support/pages/how-determine-ssltls-protocol-and-cipher-suite-used-each-active-system-tls-connection-ibm-i



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    Original Message