Creating the key database file

The first step to enable SSL and TLS for LDAP is to create the key database file.

The LDAP server must be configured for SSL and TLS by using the Server Authentication method only. The Server and Client Authentication method is not supported.

To create the key database file, use the IBM GSKit tool gsk8capicmd_64, which is in the <GSKit_install_dir>/bin/ directory. If the computer is a Db2 server, make sure that you use the same GSKit tools as Db2; for more information, see Using the GSKit tools.

If you have a server-side certificate (server.der), go to Adding the certificate file to the library server.
If you do not have a server-side certificate, go to Creating a server-side certificate.

Creating a server-side certificate

To create a server-side certificate, complete the following steps:

Go to the /usr/local/ibm/gsk8_64/bin directory, and then run this command:

gsk8capicmd_64 -keydb -create -db serverkey.kdb -pw mypassword –stash serverkey.kdb

Add the serverkey.kdb file to the LDAP server for certificate verification.

Create a certificate for serverkey.kdb:

gsk8capicmd_64 -cert -create -db serverkey.kdb -pw mypassword -label serverlabel -dn "cn=hostname,o=ibm.com" -expire 7300 -ca true -sigalg SHA256_WITH_RSA -size 2048

Replace hostname with the name of the host computer (do not use its IP address.)

Export the certificate file:

gsk8capicmd_64 -cert -extract -db serverkey.kdb -pw mypassword -label serverlabel -target server.der -format binary

Adding the certificate file to the library server

You must send the certificate to the Content Manager Enterprise Edition Library server, and then add it to the cacerts of the Java runtime.

Generate the client certificate library (clientkey.kdb):
```
gsk8capicmd_64 -keydb -create -db clientkey.kdb -pw mypassword
```

Import the server-side certificate:

gsk8capicmd_64 -cert -add -db clientkey.kdb -pw mypassword -label serverlabel -file server.der -format binary

Check the certificate:

gsk8capicmd_64 -cert -list all -db clientkey.kdb -pw mypassword -type cms

Copy the clientkey.kdb file to the directory that is specified by the IBMCMROOT/CMGMT environment variable on the library server computer.

Next, see Configuring the system administration client for SSL and TLS communication.