IBM Cloud Docs
SSL connectivity

SSL connectivity

The Db2 on Cloud database uses a certificate for SSL connections that is issued by a third-party digital certificate authority (CA).

The CA certificate is part of the Db2 driver package. If your application connects with a driver from the Db2 driver package, you do not need to download the certificate separately. You can download the Db2 driver package from the web console.

However, if your application has its own driver, you might need to download the certificate separately. You can download the certificate from the web console.

Secure Sockets Layer (SSL) is a security protocol that provides communication privacy. SSL enables client and server applications to communicate in a way that is designed to prevent eavesdropping, tampering, and message forgery. SSL-enabled client applications use standard encryption techniques to help ensure secure communication.

Configuring your Db2 client

The IBM Global Security Kit (GSkit) ships with Db2 release 9.5 and later. However, if the GSKit needs to be downloaded and configured, see Configuring GSKit.

  1. Download the SSL certificate from the web console into a new directory:

    db2inst1@macing1:/home/db2inst1> mkdir SSL
db2inst1@macing1:/home/db2inst1> cd SSL
db2inst1@macing1:/home/db2inst1/SSL>

  2. Create keystore in the SSL directory. The following example command pertains to Linux:

    gsk8capicmd_64 -keydb -create -db "mykeystore.kdb" -pw "passw0rd" -stash

    You must have the ability to write to the directory or you will get an error.

  3. Add SSL certificate to the keystore. The following example command pertains to Linux:

    gsk8capicmd_64 -cert -add -db "mykeystore.kdb" -pw "passw0rd" -label ACIBLUDB_SSL -file /home/db2inst1/SSL/DigiCertGlobalRootCA.crt

  4. Update the Db2 database manager. The following example command pertains to Linux:

    db2 update dbm cfg using SSL_CLNT_KEYDB /home/db2inst1/SSL/mykeystore.kdb
db2 update dbm cfg using SSL_CLNT_STASH /home/db2inst1/SSL/mykeystore.sth

Connecting to your database

The hostname, port, user_name, and password of the <BLUDB_database_server> can be found in the Service credentials for the service in the IBM Cloud Console.

  1. Catalog the node and database. The following example commands pertain to Linux:
    db2 catalog tcpip node ACICLD_S remote <hostname_of_BLUDB_database_server> server <port_of_BLUDB_database_server> security SSL

    db2 catalog db BLUDB as ACIBLU_S at node ACICLD_S
  2. Connect to your database with an SSL connection. The following example commands pertain to Linux:
    db2 terminate

    db2 connect to ACIBLU_S user <user_name> using <password>

For more information, see Configuring Secure Sockets Layer (SSL) support in non-Java Db2 clients.

Configuring GSKit

  1. Download the IBM Global Security Kit (GSKit) by selecting the GSKit appropriate for your operating system (OS).

  2. Download the SSL certificate from the Connection Information section of the Db2 on Cloud web console. Store the SSL certificate file in a directory that can be referenced in a subsequent command.

  3. Install the GSKit. See the following links for instructions:

    For more details, see IBM Global Security Kit global installation instructions overview

  4. Set environment variable paths:

    • AIX: LIBPATH /usr/opt/ibm/gsk8/lib

    • Linux: LD_LIBRARY_PATH /usr/local/ibm/gsk8/lib

    • UNIX: LD_LIBRARY_PATH /opt/ibm/gsk8/lib

    • Windows: PATH <installation_directory>\gsk8\bin <installation_directory>\gsk8\lib (lib64 for GSKit 64-bit)