Expired SSL Certificate for DB2 z/OS source - how to update it?
Hi all,
I have a DB2 for z/OS source endpoint on Qlik Replicate configured with SSL. Today, tasks connected to this endpoint have been failing with the following error:
SQL30081N A communication error has been detected.
Communication protocol being used: "SSL".
Communication function detecting the error: "sqlccSSLSocketSetup".
Protocol specific error code(s): "446"
The DB2 team confirmed that there had been changes to the SSL certificate on the mainframe side, and provided us with the updated certificate to install on the client side, where Qlik Replicate is running.
Could someone help me understand:
How do I replace/update the certificate in the existing keystore, without having to recreate it from scratch?
After updating the certificate, is it necessary to restart the entire Qlik Replicate Server service, or is it enough to stop and restart the individual task?
There are other active tasks connecting to the same DB2 endpoint that are currently still working (likely because their connection was established before the certificate change) — do I need to be careful about those when applying the change?
Thanks in advance to anyone who has dealt with a similar situation!
Hello, You just need to import the new certificate into your existing keystore with GSKit, then restart the Qlik Replicate Server service so it reloads the SSL context. Restarting only the task won’t be enough, and once restarted all tasks will use the updated certificate. Active ones may keep running until they reconnect, so plan a controlled restart. Myaccessflorida
Yes. For Qlik Replicate + DB2 for z/OS, the important point is that the SSL configuration is handled through the DB2 client/keystore settings rather than by recreating the Replicate endpoint. Qlik documents SSLClientKeystoredb and SSLClientKeystash as the relevant DB2 z/OS SSL properties
Hello, You just need to import the new certificate into your existing keystore with GSKit, then restart the Qlik Replicate Server service so it reloads the SSL context. Restarting only the task won’t be enough, and once restarted all tasks will use the updated certificate. Active ones may keep running until they reconnect, so plan a controlled restart. Myaccessflorida
As a potential alternative, because getting GSK is an absolute pain in the butt (IBM downloads...) We have this in our additional connection properties for our zOS source:
