Detections
Analytics

8.1.1 Configure a Server-side Key Store for TLS (SSL_SVR_KEYDB)

Information

To enable TLS support in a Db2 server, it is necessary to configure a key store that will contain certificates to be used for secure TLS communication between a Db2 client and Db2 server.

Rationale:

On the server side, Db2 requires a key store to be configured. Otherwise, TLS support cannot be enabled.

Solution

Perform the following to set SSL_SVR_KEYDB:

Attach to the Db2 instance.

db2 => attach to <db2instance>

Run the following command, where <path> is the fully qualified path to the keystore file:

db2 => update dbm cfg using SSL_SVR_KEYDB <path>

(Optional) To use the Microsoft certificate store on Windows, set SSL_SVR_KEYDB to GSK_MS_CERTIFICATE_STORE:

db2 => update dbm cfg using SSL_SVR_KEYDB GSK_MS_CERTIFICATE_STORE

If a keystore file is being used, ensure only the instance owner and administrators have access to the file. Do not grant world readable or world writable permissions on the keystore file.

See Also

https://workbench.cisecurity.org/benchmarks/23492

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Windows

Control ID: c3ee6153cc0c4feb5e32be1e505426dde0693fe89ac3649d0182782802425659