CONCLUSIONES Y RECOMENDACIONES

The graphical utility ikmgui utility (IBM Key Management GUI) is provided for IBM AIX, Windows NT, and a number of other IBM and non-IBM platforms to manage SSL X.509v3 certificate databases (also known askeyring filesor

keyring databases). Its use is required to configure and use Secure Sockets Layer (SSL). The ikmgui utility replaces the mkkf and ikeyman utilities used with earlier versions of IBM SSL support. With the IBM SecureWay Directory (and associated clients), both client and server keyring files are managed with ikmgui.

The ikmgui utility, together with the SSL libraries, form the IBM SSL toolkit known as GSKit (Global Security Kit). GSKit provides the SSL protocol functions as well as a set of Certificate Management Services (CMS) functions. These CMS functions provide access to the certificate database

(the keyring file) as well as functions such as validating client certificates (including Certificate Revocation List processing). The current version is GSKit Version 3, which supports SSL Version 3.0, C/C++ for clients and servers and Java for clients.

GSKit is not available for OS/400. Instead, in order to configure and use SSL on OS/400, you need to install Digital Certificate Manager (DCM), Option 34 of OS/400, and the IBM Cryptographic Access Provider licensed program with program number 5769-AC1, AC2, or AC3. Please read the

documentation pertinent to these options for installation and configuration instructions.

Starting with V2R7, the LDAP server on OS/390 uses SystemSSL, which, as part of the Common Data Security Architecture (CDSA), ships with the OS/390 base. It is based on the GSKit as described above for other

platforms, such as AIX and Windows NT. You should refer to the respective system documentation or visit the Web sitehttp://www.ibm.com/s390. Since strong encryption (as provided by SSL) is controlled by export and other regulations in the U.S. and other countries, different versions of GSKit exist for different countries. While the installable options differ among these versions, the user interface and configuration steps are generally the same as described in the following sections.

5.3.1 GSKit Installation

GSKit is a separately installable option required only when SSL security is to be used. GSKit might already be installed on your system if another

application required it to be installed. GSKit is shipped with the IBM SecureWay Directory in the appropriate version for your country. Please check for and follow any installation instructions that came with the product. For your convenience, the following are some hints for Windows NT and AIX (for OS/400 and OS/390; see the comments in the last section):

Windows NT – GSKit uses the Windows InstallShield for installation. GSKit normally ships as a self-extracting ZIP file that you need to unpack first. For Encryption technology is subject to government regulations in the U.S. and other countries. Such regulations have changed recently and may change in the future. Due to this, the SSL packaging and implementation may be different as the product rolls out or may change thereafter.

example, on a command line, change to the directory where the GSKit file resides and type:

gskru301 <path> /d

The <path> parameter (optional) specifies a destination directory for the unpacked files and /d (optional) specifies that subdirectories will be created. If no parameters are given, the files are unpacked to the current directory. Note that the filename (gskru301.exe) may be different depending on the actual version you are using. The setup.exe file (one of the unpacked files) for GSKit must be called from the command line with a parameter as follows (do not double-click on the file icon to start it):

setup ldap

This registers LDAP as an application for GSKit. A second command line parameter allows you to select an installation language other than English. Refer to the documentation for a list of available languages. If GSKit was already installed, you must still run this command, which will then add LDAP as an application (installation will not actually take place again).

AIX – GSKit is shipped as one or more installable fileset(s). Installation should be done using the installpcommand (orSMIT install_latest). After the GSKit is installed, the commandikmguiis available to start the Graphical User Interface.

5.3.2 The ikmgui Utility

The ikmguiutility with its graphical user interface is used to manage certificates. The specific tasks you can perform withikmguiinclude:

• Create a key pair and request a certificate from a CA • Receive a certificate into a keyring file

• Change a keyring password • Show information about a key • Delete a key

• Make a key the default key in the keyring file • Export a key

• Import a key into the keyring file • Designate a key as a trusted root • Remove trusted root key designation

To runikmguion AIX, you need to have the Java Development Toolkit (JDK) installed and the JAVA_HOME environment variable pointing to its root directory. For example, the following commands run in a default installation:

# export JAVA_HOME=/usr/jdk_base # ikmgui

After starting, the main window of ikmgui is presented as shown in Figure 23 .

Figure 23. IBM key management (ikmgui) utility main window

The tasks that you need to run SSL from the list above are explained in the following sections.