Reference Manual

10.5.5
- 10.5.6
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5.1
- 10.5
- 10.4.1
- 10.4.0 HotFix 1
- 10.4.0

Back Next

Creating a Personal Certificate with OpenSSL

To create a personal or subject identification certificate, issue the OpenSSL req and x509 commands, and then concatenate the two files that these commands create.

Alternatively, you can create a personal certificate using one of the following methods:

Export an existing Windows certificate, and convert it to .pem format using OpenSSL.

Generate a personal certificate on the mainframe using RACF, export the certificate, and convert it to .pem format using OpenSSL.

To create a personal certificate using OpenSSL, perform the following actions:

If the OpenSSL program is not already running, enter the following command at the command prompt:

openssl

The OpenSSL> prompt appears.

To generate a private key and a request for a personal certificate, issue the OpenSSL req command:

OpenSSL> req -newkey rsa:2048 -sha1 -keyout personalkey.pem -out subjectidreq.pem

-newkey rsa:2048: Requests a new certificate request and a 2048-bit RSA private key.
-sha256: Specifies to use the SHA-256 hash function (message digest) to sign the request.
-keyout personalkey.pem: File name to which to write the private key for the personal certificate.
-out rootreq.pem: File name to which to write the certificate request for the personal certificate.

At the prompt for a pass phrase, enter the pass phrase that you provided when you created the CA certificate.

At the prompt for a PEM pass phrase, enter a second pass phrase. You will specify this pass phrase in the PASS= parameter of the SSL statement in the DBMOVER configuration file.

Respond to the series of prompts that OpenSSL displays. You can use the same responses that you provided for the CA certificate request.

To generate a personal certificate, issue the OpenSSL x509 command:

OpenSSL> x509 -req -in personalreq.pem -sha1 -CA rootcert.pem -CAkey rootkey.pem -CAcreateserial -out personalcert.pem

-req: Specifies that the input is a certificate request, rather than a certificate.
-in personalreq.pem: Name of the input certificate request file that you created in the previous step.
-sha256: Specifies to use the SHA-256 hash function (message digest) to sign the request.
-CA rootcert.pem: File name of the CA root certificate that you created in the previous step.
-CAkey rootkey.pem: Specifies to use the CA private key that you created in the previous step to sign this certificate.
CAcreateserial: Creates the CA serial number file.
-out personalcert.pem: File name to which to write the subject identification certificate.

Concatenate the personal key and personal certificate.

On Windows, enter the following command:

type personalcert.pem personalkey.pem > personalcertkey.pem

On Linux or UNIX, enter the following command:

cat personalcert.pem personalkey.pem > personalcertkey.pem

This step creates the file personalcertkey.pem. Specify this value in the KEY= parameter of the SSL statement in the DBMOVER configuration file.

Rename Saved Search

Table of Contents

Reference Manual

Reference Manual

Creating a Personal Certificate with OpenSSL

Creating a Personal Certificate with OpenSSL