Enabling Secure HTTPS for the BRMS Web Interface

Secure HTTPS traffic for the BRMS web interface requires a digital certificate. A digital certificate provides two functions:

Providing a way to encrypt communication between the web browser and the server
Verifying the identity of the server to prevent a man-in-the-middle attack.

Depending on the type of digital certificate you configure, the digital certificate will help with either encrypting communication or with both encrypting communication and verifying the identity of the server.

Before you begin

This step requires the following:

IBM 5770SS1 Option 34 - Digital Certificate Manager is installed
The *SYSTEM certificate store is created

To create the *SYSTEM certificate store, use the following steps:

In a web browser, enter http://mysystem:2001/dcm, where mysystem is the host name or IP address of the system. This opens IBM Digital Certificate Manager for i.
Log in with an IBM i profile with sufficient authority.
Click on Create Certificate Store on the left-hand navigation menu
On the right-hand side of the page select *SYSTEM.

Note: If the *SYSTEM option is not available in the list, it indicates that there is a *SYSTEM store already created on this system, and these steps have already been performed.

Create a password for the *SYSTEM store and click Create.

Note: The password is case-sensitive. It is recommended not to use special characters. This password is not attached to a user profile and it will not lock you out of the system after too many attempts.

Procedure

After the *SYSTEM certificate store is created, the procedure consists of the following steps:

Choose a type of certificate to use by following one of the following options
1. Creating a Self-Signed Certificate
2. Importing a Signed Certificate
Assigning the certificate to the BRMS Webserver
Enabling the secure HTTPS server
Restarting the BRMS Webserver

1a. Creating a Self-Signed Certificate

A self-signed certificate provides a way to encrypt communication between the web browser and server. However, because the certificate is self-signed, the identity of the server cannot be verified. While a self-signed certificate is still much more secure than non-secured HTTP traffic, it does not protect against a man-in-the-middle attack.

To create a self-signed certificate, use the following steps:

Create a Local Certificate Authority (if one does not already exist)
Create a Certificate Authority (CA) Certificate (if one does not already exist)
Use the Local Certificate Authority to create a self-signed certificate

In a web browser, enter http://mysystem:2001/dcm, where mysystem is the host name or IP address of the system. This opens IBM Digital Certificate Manager for i.
Log in with an IBM i profile with sufficient authority.
Click on Create Certificate Store on the left-hand navigation menu.
On the right-hand side of the page select Local CA.

Note: If the Local CA option is not available in the list, it indicates that there is already a local certificate authority on this system, and these steps have already been performed.

Create a password for the Local CA store and click Create.

Result

The *SYSTEM certificate store is created on the node.

In a web browser, enter http://mysystem:2001/dcm, where mysystem is the host name or IP address of the system. This opens IBM Digital Certificate Manager for i.
Log in with an IBM i profile with sufficient authority.
In the left-hand menu, select Local CA
If Local CA is not in the left-hand menu, open it by doing the following:
1. Select Open Certificate Store.
2. Enter the password for the local certificate authority, and click open.
3. The Local CA will now automatically be selected in the left-hand menu.
Under Certificate Authority (CA) Certificates, create one if one does not exist by selecting Create.
Fill n the required fields. At a minimum:
1. Common name: Provide a unique common name for this. For example: MyCompany MySystem CA
2. Organization Name: Provide the name of your company
3. State or Province: Provide the state or province of the system
4. Country or Region: Provide the two character country code
Click Create.

Result

The CA Certificate is created on the node.

In a web browser, enter http://mysystem:2001/dcm, where mysystem is the host name or IP address of the system. This opens IBM Digital Certificate Manager for i.
Log in with an IBM i profile with sufficient authority.
In the left-hand menu, select the *SYSTEM certificate store.
If the *SYSTEM certificate store is not in the left-hand menu, open the certificate store:
1. Select Open Certificate Store in the left-hand menu.
2. Select *SYSTEM on the right-hand side of the screen.
3. Enter the password for the *SYSTEM certificate store.
4. Click Open.
Under certificates on the right-hand side, select Create.
For type, select Local CA
Fill in the required fields. At a minimum:
1. Label: Provide a unique common name for this. For example: MyCompany MySystem BRMS Web Interface
2. Organization Name: Provide the name of your company
3. State or Province: Provide the state or province of the system
4. Country or Region: Provide the two character country code
Click Create.

Result

The self-signed certificate is created on the node.

1.b Importing a Trusted Certificate

To import a trusted certificate, follow the instructions in the IBM Documentation for Digital Certificate Manager.

2. Assigning the Certificate to the BRMS Webserver

In a web browser, enter http://mysystem:2001/dcm, where mysystem is the host name or IP address of the system. This opens IBM Digital Certificate Manager for i.
Log in with an IBM i profile with sufficient authority.
In the left-hand menu, select the *SYSTEM certificate store.
If the *SYSTEM certificate store is not in the left-hand menu, open the certificate store:
1. Select Open Certificate Store in the left-hand menu.
2. Select *SYSTEM on the right-hand side of the screen.
3. Enter the password for the *SYSTEM certificate store.
4. Click Open.
Select Manage Application Definitions.
Search for QIBM_QBRM_WEB.
Click on the + symbol at the lower-right of the QIBM_QBRM_WEB box.
Click on Assign Certificates.
Click the box for the certificate you wish to assign, and click Assign.

3. Enabling the secure HTTPS server

Enable the secure HTTPS server by using the HTTPS(*ON *SAME) parameter on the CHGWEBBRM command. If no other configuration options have changed, by default BRMS is equivalent to the following command:
CHGWEBBRM HTTP(*AUTO 2088) HTTPS(*ON 2089)

This command enables the non-secured HTTP server on port 2088, configured to automatically redirect users to the secured HTTPS server on port 2089.
Alternatively, the non-secured server can be disabled by using the following command:
CHGWEBBRM HTTP(*OFF *SAME) HTTPS(*ON 2089)

4. Restarting the BRMS Web Interface

Restart the BRMS Web Interface for the new changes to take effect. For information on restarting the BRMS web interface see Restarting the BRMS Web Interface.