Configuring the server to connect to another server by using SSL

To ensure that data is encrypted for server-to-server communication, configure servers to communicate with servers by using the SSL protocol.

Before you begin

You must have the certificate and the port number for the server that you are connecting to. For more information, see Configuring the server to accept SSL connections.

Tips:

If both servers are using IBM Storage Protect V8.1.2 or later software, SSL is automatically configured. Manual configuration is recommended but not required. If either server is using IBM Storage Protect software earlier than V8.1.2 or Tivoli Storage Manager software earlier than V7.1.8, you must manually configure SSL.
In V8.1.2, you must manually configure storage agents to use SSL. In V8.1.3, storage agents are automatically configured to use SSL.

In the procedure, the following server addresses are used as examples:

Create the server key database by starting the server. The server key database file, cert.kdb, is stored in the server instance directory.
For each server, import the other server's self-signed certificate file (cert256.arm) or CA-certificate files. To import the self-signed certificate, issue the following command:
```
gsk8capicmd_64 -cert -add -label server_ip_address -db cert.kdb -stashed 
-file cert256.arm
```
Tip: Use the IP address of the server as the label name.
From each server, you can view the certificates in the key database by issuing the following command:
```
gsk8capicmd_64 -cert -list -db cert.kdb -stashed
```
Restart the servers.

Issue the DEFINE SERVER command.

For ServerA, issue the following command:

DEFINE SERVER BFB hla=bfb.tucson.example.com lla=1542 
serverpa=passwordforbfb SSL=YES

For ServerB, issue the following command:

DEFINE SERVER BFA hla=bfa.tucson.example.com lla=1542 
serverpa=passwordforbfa SSL=YES