security=SSL Using custom certificate

[developer992]

I have a debian based linux container and would like to import the certificate into the OS keystore

I run update-ca-certificates but it doesn't work

Is installing GSK and following this guide the only way? https://www.ibm.com/docs/en/db2-warehouse?topic=drivers-secure-sockets-layer-ssl

Seems quite complicated to install this to debian https://www.ibm.com/docs/en/db2/11.5.x?topic=linux-installing-gskit-packages

[Earammak]

@developer992 , I hope you have gone though this https://github.com/ibmdb/python-ibmdb/blob/master/README.md#example-of-ssl-connection-string.

[developer992]

Yes, thank you

It works with SSLServerCertificate=PATH but I'm trying to import it into the OS store and use it without this param and the only other example there is to connect to dashDB in IBM Cloud which I don't think we have. The third example uses GSKit which I'm trying to avoid installing into a container.

[bimalkjha]

@developer992 If SSLServerCertificate=PATH is working, use it. This is the only way to tell ibm_db that where is your server certificate file. Apart from it, you have to install GSKit, create gskit keystore and add certificate to it, then point the GSKit keystore using SSLClientKeystoredb=keystorepath; and SSLClientKeystorepwd=keystorepwd; in connection string. SSLClientKeystoredb tells ibm_db that my certificate is here to send it on server for verification. SSLServerCertificate directly gives the certificate file path to ibm_db, that ibm_db will send on server for authentication when Security=SSL; is used in connection string. ibm_db can not read certificate from OS keystore. Btw, do you have /etc/ssl/certs/ca-certificates.crt file on Debian and does SSLServerCertificate=/etc/ssl/certs/ca-certificates.crt works? Thanks.

[bimalkjha]

The connection to DashDB and db2 on cloud works without SSLServerCertificate because those server are using CA signed certificates which is bundled with GSKIt by default and ibm_db uses it from GSKit library which is part of clidriver. If you db2 server uses a CA signed certificate whose root certificate is part of GSKit library, connection can work without using SSLServerCertificate same as dashdb. Thanks.