Enabling TLS connections for a Db2 database

Use this procedure to enable TLS communication with Db2 databases.

Before you begin

This procedure should be performed after running configImpactSSL.sh to configure Impact connections to use SSL. For more information on configImpactSSL.sh, see Configuring SSL with scripts.

Procedure

Set up the Db2 server with TLS v1.2.
1. Install Db2 server v11.5 and upgrade to v11.5.7.0 version.
  
  Install the Db2 server base version v11.5 and then upgrade it to the v11.5.7.0 version.
  
  See TLS configuration of Db2
2. Install the Global Security Kit.
  
  Install the Global Security Kit which will be used to create the keystore and certificate.
  
  See IBM Global Security Kit global installation instructions overview
3. Create a keystore with GSKit.
  From a terminal window, run the following command to create a keystore:
```
gsk8capicmd_64 -keydb -create -db server.p12 -pw myServerPassw0rdpw0 -stash
```
  For parameter descriptions, see Creating a keystore with GSKit
4. Create a self-signed certificate with GSKit.
  Open GSKit and run the following command:
```
gsk8capicmd_64 -cert -create -db server.p12 -stashed -label myselfsigned -dn "CN=myserver.mycom
```
  For parameter descriptions, see Creating a self-signed certificate with GSKit
5. Extract the self-signed certificate from the keystore.
  Extract your self-signed certificate by running the following GSKit command:
```
 gsk8capicmd_64 -cert -extract -db server.p12 -stashed -label <myselfsigned> -target <myselfsigned.crt> -format ascii
```
  For parameter descriptions, see Distributing a self-signed certificate to your Db2 clients
6. Configure TLS support on your Db2 server.
  Set the SSL_SVR_KEYDB and SSL_SVR_STASH database manager configuration parameters to reference the key store and stash file that were created earlier. These must be fully qualified paths:
```
   db2 update dbm cfg using SSL_SVR_KEYDB /path/to/server.p12
   db2 update dbm cfg using SSL_SVR_STASH /path/to/server.sth
```
  Set the ssl_svr_label configuration parameter to the label of the digital certificate created earlier.
```
db2 update dbm cfg using SSL_SVR_LABEL myselfsigned
```
  Set the SSL_SVCENAME configuration parameter to the port on which Db2 listens for TLS connections.
```
db2 update dbm cfg using SSL_SVCENAME 25001
```
  Set the SSL_VERSIONS parameter to TLSV12.
```
db2 update dbm cfg using SSL_VERSIONS TLSV12
```
  Add the value TLS to the DB2COMM registry variable.
```
db2set -i db2inst1 DB2COMM=SSL
```
  Where:
  
  db2inst1 is the Db2 instance name.
  
  The database manager can support multiple protocols at the same time. For example, to enable both TCP/IP and TLS communication protocols, run the following command:
```
db2set -i db2inst1 DB2COMM=SSL,TCPIP
```
  See Configuring TLS support on a Db2 server
  
  The following example shows database manager configurations for TLS v1.2:
```
   SSL server keydb file                   (SSL_SVR_KEYDB) = /home/db2inst1/db2/server.p12
   SSL server stash file                   (SSL_SVR_STASH) = /home/db2inst1/db2/server.sth
   SSL server certificate label            (SSL_SVR_LABEL) = myselfsigned
   SSL service name                         (SSL_SVCENAME) = 25001
   SSL cipher specs                      (SSL_CIPHERSPECS) =
   SSL versions                             (SSL_VERSIONS) = TLSV12
   SSL client keydb file                  (SSL_CLNT_KEYDB) =
   SSL client stash file                  (SSL_CLNT_STASH) =
```
7. Restart the Db2 instance.
```
- db2stop
- db2start
```
Set up the Impact server connecting on TLS v1.2 with the Db2 server.
1. Enable the SSL on the Impact server by running the configImpactSSL.sh script. The default SSL is TLS v1.2.
2. Import the myselfsigned.crt generated above to the Impact truststore:
```
/opt/IBM/tivoli/impact/sdk/jre/bin/keytool -import -alias db2certmyselfsigned -file myselfsigned.crt -keystore trust.jks
```
3. Restart the Impact server.
Set up the Db2 server with TLS v1.3.
1. Install Db2 server v11.5 and upgrade to v11.5.8.0 version.
  
  Install the Db2 server base version v11.5 and then upgrade it to the v11.5.8.0 version.
2. Enable TLS v1.3 support in the new Db2 environment where TLS v1.2 was not already in use.
  
  To enable TLS v1.3 in a new environment, see the following topics:
  
  IBM Global Security Kit global installation instructions overview
  
  Creating a keystore with GSKit
  
  Creating a self-signed certificate with GSKit
  
  Distributing a self-signed certificate to your Db2 clients
  
  Configuring TLS support on a Db2 server
3. Enable TLS v1.3 in a Db2 environment where TLS v1.2 is already in use.
  Update the SSL_VERSIONS database manager configuration to TLSV13:
```
db2 update dbm cfg using SSL_VERSIONS TLSV13
```
  See Enabling TLS 1.3 in a Db2 environment where TLS is already in use
  
  The following example shows database manager configurations for TLS v1.3:
```
   SSL server keydb file                   (SSL_SVR_KEYDB) = /home/db2inst1/db2/server.p12
   SSL server stash file                   (SSL_SVR_STASH) = /home/db2inst1/db2/server.sth
   SSL server certificate label            (SSL_SVR_LABEL) = myselfsigned
   SSL service name                         (SSL_SVCENAME) = 25001
   SSL cipher specs                      (SSL_CIPHERSPECS) =
   SSL versions                             (SSL_VERSIONS) = TLSV13
   SSL client keydb file                  (SSL_CLNT_KEYDB) =
   SSL client stash file                  (SSL_CLNT_STASH) =
```
4. Restart the Db2 instance.
```
- db2stop
- db2start
```
Set up the Impact server connecting on TLS v1.3 with Db2 server.
1. Enable the SSL on the Impact server by running the configImpactSSL.sh script. The default SSL is TLS v1.2.
2. Enable the SSL with TLS v1.3 on Impact server by running the configImpactTLSv13.sh script.
3. Import the myselfsigned.crt generated above to the Impact server truststore:
```
/opt/IBM/tivoli/impact/sdk/jre/bin/keytool -import -alias db2certmyselfsigned -file myselfsigned.crt -keystore trust.jks
```
4. Set the Db2 driver props file to use SSL version TLS v1.3.
  For example, in the file $IMPACT_HOME/etc/NCI_com.ibm.db2.jcc.DB2Driver_myDB2ds.props, add the following property:
```
   sslVersion=TLSv1.3
```
  Where:
  
  NCI in the Db2 driver props file is the name of the Impact server.
  
  myDB2ds in the Db2 driver props file is the name of your Db2 data source name.
5. Restart the Impact server.
  
  Note: To establish secured TLS connection between DB2 and Impact, both DB2 and Impact should be at the same TLS level.