May I hijack this thread to say that if you find the whole certificate thing
somewhere between mysterious and annoying, let me suggest three sessions at
SHARE, coming up in less than two months in Sacramento. Our goal for the
sessions is to take away the mystery and thereby perhaps make certificates less
annoying.
Monday, March 12, 4:30 PM - 5:30 PM
Digital Certificates -- How they Really Work, Part 1 of 3
Room: Room 304/305
Session Number: 21967
Speaker: Charles Mills
Tuesday, March 13, 11:15 AM - 12:15 PM
Digital Certificates - Real-World Usage on z/OS, Part 2 of 3
Room: Regency B
Session Number: 22476
Speaker: Phil Smith III
Tuesday, March 13, 4:30 PM - 5:30 PM
Digital Certificates - Lifecycle Managment on z/OS, Part 3 of 3
Room: Room 304/305
Session Number: 22470
Speaker: Ross Cooper
Charles
-----Original Message-----
From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf
Of John Eells
Sent: Monday, January 15, 2018 5:59 AM
To: [email protected]
Subject: Please Read: Server Certificates Expiring - Soon!
Last week, one of the RECEIVE ORDER server certificates expired. The other IBM
servers you use for getting products and service, and those for the testcase,
ecurep, and Blue Diamond servers will also expire over the next several months.
Normally, impending expiration is not be a big deal; IBM just gets new
certificates ahead of the expiration dates, and you never notice.
However, as I understand it, DigiCert acquired GeoTrust. All the IBM server
certificates in question are GeoTrust certificates. There is rather more to
the story, but the net is that IBM will replace all its GeoTrust certificates
with new ones from DigiCert. This has already been done for one RECEIVE ORDER
server, eccgw02.rochester.ibm.com. The GeoTrust CA certificate will no longer
work with this server.
To continue to use the servers as the certificates are replaced with new ones
from DigiCert, you will need to get and install a new DigiCert Global Root CA
certificate.
If you use the eccgw02.rochester.ibm.com RECEIVE order server, you can buy some
time by using eccgw01.boulder.ibm.com instead until you get the new CA
certificate.
Look for a WSC Flash later today (I hope) with more-detailed information and
instructions. We will update it as we learn more, but the next deadline is
some time in April, when we are likely to replace additional server
certificates. As I understand it, they must all be done by August.
We believe the required action, to get and install a new DigiCert Global Root
CA certificate, will not change. My recommendation is that you start the
process to do that soon so that you do not lose access to the IBM servers.
--
John Eells
IBM Poughkeepsie
[email protected]
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to
[email protected] with the message: INFO IBM-MAIN
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
