Before you begin SSL configuration for PowerExchange, your organization should have a local CA certificate from a well-known CA vendor. A self-signed CA certificate can be generated instead for internal use, such as connections within your organization's network or internal testing.
The steps described in this task should be performed by security administrators. Security administrators have specific permissions and system access that allow them to generate and manage security certificates and policy files.
All certificates created for use with PowerExchange must be generated to the X.509 standard. For example, the PKCS7 format meets the X.509 standard, so it can be used to generate the certificates.
To implement SSL support in PowerExchange, complete the following tasks:
Configure each z/OS server.
Configure the DBMOVER file for the PowerExchange Listener and specify the ports to be used for secure connections.
Update the rules in AT-TLS policy file specifying the job names and ports to be used for secure connections.
Create a personal certificate.
Configure each Linux, UNIX, Windows or IBM i machine.
Create a CA certificate.
Create a personal certificate.
Customize the DBMOVER configuration file on the server.
If remote peer certificate validation is performed, then the Certificate Authority that issued the remote certificate must be present as a trusted CA in the local system:
On z/OS, remote peer certificate validation is performed if the AT-TLS rule specifies a Handshake Role of "ServerWithClientAuth" while no remote peer certificate validation is performed if the AT-TLS rule specifies a Handshake Role of "Server".
On non- Z/OS listeners, remote peer certificate validation is performed according to the SSL_REQ_CLNT_CERT parameter.
On Linux, UNIX, and Windows clients, remote peer certificate validation is performed according to the SSL_REQ_SRVR_CERT parameter.
Verify the secure connections between PowerExchange clients and servers using DTLREXE PING.