Problems Importing Certificates to the i using DCM.

[kieranohagan]

Hello,

I am having major issues getting a certificate loaded onto our IBM I, which is at V7R1.

Initially, I tried to load a .PFX cert. into the *SYSTEM Store but got the following message "An error occurred during certificate validation. The issuer of the certificate may not be in the certificate store or the issuer may not be enabled."

It transpired (apparently) that I needed to extract the Root (2) certs that were stored within the ,pfx and load them first ?

With the help of a colleague, I have been able to extract the root certs and have now uploaded them to the IFS, but again I cannot import the first Root via DCM due to the following error:


"The validity period does not contain today or does not fall within its issuer's validity period. Be sure that the date, time, and the offset from GMT are correct on your system. If you observe daylight savings time, be sure that it is correct on your system as well as on the system that is used by your browser and by the CA."

The i has the date and time set correctly and I can see that the dates on the cert. are also valid.

I read online somewhere that it sometimes helps to import and export the certs via IE and have done this also but again to no avail.

I am at a loss as what to do next.

Can anybody help ?

Thanks

Kieran

[Scott Klement]

Re: Problems Importing Certificates to the i using DCM.

For some reason, it thinks that the root certificate isn't valid. (Either the validity period hasn't begun yet, or has expired.)

Those of us reading your message have no basis to know why that would be -- unless you wanted to post the certificates for us to look at? Otherwise, you should attempt to discover why it thinks this.

Would this be easier if the certs were not in PFX format?

Why would importing into Internet Explorer make any difference?

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

Scott,

Thanks for coming back to me.

I have attached a document showing that the cert. has valid dates (from 27th Jan 2015 to 27th Jan 2039). This is after the cert. has been extracted from the .pfx. I have tried to load as .pfx and as an individual cert. Both without success and the date issue is when I try and load it as a .cer.

The reason I mentioned the import/export through IE was because I had read that on another thread when I was trying to understand what was going on (in fact, I thought it was a post that you had made, though obviously I must be wrong there!). It made no difference though, so it is obviously a red herring.

Any other ideas ?

Kieran

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

Scott,

This has now moved on. I was advised to create a Local System Cert. and to make sure I had my 3 certs to import, each as a .cer to be loaded one at a time, starting with the first root (which is what I was doing previously anyway).

So I have created a CA and tried to load the first (ROOT) .cer (using the Import Certificate Server or Client option) and I now get this message:



"No request key is found for the certificate. If you are trying to receive the signed certificate, you must be using the same certificate store that was used when the certificate was requested. If this is a CA certificate, you should use the function for importing a CA."

Am I supposed to issue a request for a certificate before I can import it ?

Kieran

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

Scott,

As an aside, I am going to be cheeky and ask if you could look at this post also, as I think you are probably the ideal person to answer it ? If and when I get over my cert. problem, it will be the next step in my project and I would very much appreciate your expert input.

http://www.code400.com/forum/showthread.php/13897-Understanding-tiered-Data-Structures-and-arrays

Thanks

Kieran

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

Scott,

I think I have sorted the data structure/array issue, so you can ignore that now.

I am fairly certain though that I will need help on the web service at some point (if I resolve the cert issue) and so I would be delighted if you were happy to help me with that at some point ?

Kieran

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

OK. I started again from the beginning. I asked the technical people from Skoda to send me each of the certs and have tried to add the ROOT cert. Again, I am getting an invalid date issue.

I have attached a step by step set of screen prints. Can someone please review and let me know what I am doing wrong ?

Kieran

This post has the wrong document attached! I cannot upload the correct document due to my limit being exceeded.

I cannot see how I can post the attachment here at the moment - there is another thread with the attachment here:

https://www.ibm.com/developerworks/community/forums/html/topic?id=275be479-cf27-446b-ba82-b6d7327e0a7d&ps=25

This is causing me a major problem, so I would be very grateful for any help.

Kieran

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

OK, so if you follow the link in the previous post, you will see the document that shows the steps I have taken to try and load the cert. It seems perhaps that there is an issue with the cert. Is anyone willing for me to send them the cert., so they can check it out ? I really need to try and get to the bottom of this.

Kieran

[Scott Klement]

Re: Problems Importing Certificates to the i using DCM.

Kieran,

Sorry, I'm not deliberately ignoring you, just busy :-)

I see now that you've posted this to several forums, including the IBM i Cafe and the RPG Cafe forums as well as these. This makes the discussion harder to follow because now I need to incorporate info from multiple sources, and I don't necessarily check these forums all at the same time -- so I look here, but then don't want to reply until I've also read the IBM Cafe forums, and then maybe I don't even get to them, or by the time I do, I forget. I have too much going on at once!

Right now, I'm unclear as to where you stand. I see a lot of help, etc, from Vlad over on the IBM forums. Did you get this resolved?

Have you asked IBM support to help you at all? What did they say?

[kieranohagan]

Re: Problems Importing Certificates to the i using DCM.

Scott,

Thanks for the reply.

I posted on two forums as I needed an answer and I thought there was more chance of if I did that. Perhaps I will just stick to RPG café in future (or would you recommend here ?).

Vlad has been very helpful. I sent him the ROOT cert and he loaded it and sent back .kdb and .rdb files which I loaded successfully.

Unfortunately, I still have 2 more certs to load after that. I have asked Vlad to do the same with them now but I am going to be out of the office until 27th October.

My boss was on holiday last week but I have left all of the details for him and have asked him to contact IBM.

I hope that this element of the project will be sorted soon after I return but then the next bit will be potentially even more difficult. I mentioned earlier that I am using wsdl2rpg.sh for the first time and whilst I have made some headway, I suspect that I will have some questions in the not too distant future. In fact, right now, I am not even sure how I get the certificate details to the url ? Would it be standard that the wsdl would be requesting them ?

Kieran