HTTPS-function.md

HTTPS function

• New HTTP functions based in QSYS2 - https://www.ibm.com/support/pages/node/6486889
• HTTP functions overview - https://www.ibm.com/docs/en/i/7.5?topic=programming-http-functions-overview
• HTTP options - https://www.ibm.com/docs/en/i/7.5?topic=functions-http-get-http-get-blob#rbafzscahttpget__HTTP_options
• Configuring Your IBM i System Secure Sockets Layer (SSL)/Transport Layer Security (TLS) Protocols and Cipher Suites
  https://www.ibm.com/support/pages/node/666411
• Digital Certificate Manager for i (DCM) - Frequently Asked Questions and Common Tasks( IBM i 7.3, 7.4, 7.5)
  https://www.ibm.com/support/pages/node/6607872
• SYSTOOLS Java version
• Configuring IBM i DB2 SYSTOOLS HTTP User-Defined Functions for TLS/HTTPS Secure Communications
  https://www.ibm.com/support/pages/configuring-ibm-i-db2-systools-http-user-defined-functions-tlshttps-secure-communications
• How to import a certificate for Java keystore using Java keytool
  https://www.ibm.com/support/pages/how-import-certificate-java-keystore-using-java-keytool

Grant certificate store file authority to user which running TLS (SSL) applications

• When you got GSKit Error is 6003 - Access to the key database is not allowed,
  the user profile which make HTTP request must have READ access to the certificate store file.
  
  The default system certificate store located on this path:
  /QIBM/USERDATA/ICSS/CERT/SERVER/DEFAULT.KDB
  
  This user needs *RX access to all of these directories: / (*PUBLIC default authority *RWX) /QIBM (*PUBLIC default authority *RX) /QIBM/UserData (*PUBLIC default authority *RX) /QIBM/UserData/ICSS (*PUBLIC default authority *RX) /QIBM/UserData/ICSS/Cert (*PUBLIC default authority *RX) /QIBM/UserData/ICSS/Cert/Server (*PUBLIC default authority *EXCLUDE)

  And also need *R access authority to these files: /QIBM/UserData/ICSS/Cert/Server/DEFAULT.KDB (*PUBLIC default authority *EXCLUDE) /QIBM/UserData/ICSS/Cert/Server/DEFAULT.RDB (*PUBLIC default authority *EXCLUDE)

  Or, the user must have *ALLOBJ authority

• Grant authority as following commands...(Change 'youruser' to the https function running userid) CHGAUT OBJ('/') + USER(youruser) DTAAUT(*RX) CHGAUT OBJ('/QIBM') + USER(youruser) DTAAUT(*RX) CHGAUT OBJ('/QIBM/UserData') + USER(youruser) DTAAUT(*RX) CHGAUT OBJ('/QIBM/UserData/ICSS') + USER(youruser) DTAAUT(*RX) CHGAUT OBJ('/QIBM/UserData/ICSS/CERT') + USER(youruser) DTAAUT(*RX) CHGAUT OBJ('/QIBM/UserData/ICSS/CERT/SERVER') USER(youruser) DTAAUT(*RX) CHGAUT OBJ('/QIBM/UserData/ICSS/CERT/SERVER/DEFAULT.KDB') USER(youruser) DTAAUT(*R) CHGAUT OBJ('/QIBM/UserData/ICSS/CERT/SERVER/DEFAULT.RDB') USER(youruser) DTAAUT(*R)