Using SSL/TLS database connections

Procedure

If you are upgrading database clients that use SSL/TLS connections to Client SDK 4.50.xC4W1 or newer, you may need to migrate their client keystores. For more information, see Configuring a client for SSL connections.

To perform keystore migration:

  1. If your database client installation is co-located with the database server installation, the database client continues to use GSKit as encryption library. In this case, keystore migration is not necessary.
  2. If your database client uses a stand-alone installation of Client SDK 4.50.xC4W1 or newer, and you choose to install OpenSSL for the encryption library, rather than GSKit, the following applies:
    1. Ensure to have an appropriate version of OpenSSL installed before you install Client SDK 4.50.xC4W1 or newer.
    2. If your client keystore has the GSKit-proprietary format "CMS" (file extension "*.kdb"), then this keystore needs to be converted to a PKCS#12 keystore. As the CMS format is GSKit-specific, you need the GSKit command "gsk8capicmd" (or "gsk7capicmd") in order to convert the keystore.
      Use a command like: 
      gsk8capicmd -keydb –convert –db KEYSTOREFILE.kdb -stashed
-old_format cms -new_db KEYSTOREFILE.p12 -new_pw PASSWORD
-new_format pkcs12 -pqc false
    3. Using the stand-alone client installation, create a stash file with the keystore password to use with OpenSSL. Use the new utility "onkstash" contained with Client SDK 4.50.xC4W1 (or newer) to stash the keystore password: 
      onkstash KEYSTOREFILE.p12 PASSWORD