IBM Power Ideas Portal


This portal is to open public enhancement requests against IBM Power Systems products, including IBM i. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Not under consideration
Workspace IBM i
Categories Security
Created by Guest
Created on Jan 14, 2019

RELATED IDEAS

Deploy DCM with default *SYSTEM key store

Currently DCM is deployed without a *SYSTEM KDB (key store). That means, even simple applications using https requests need to create a kdb to function properly.

As it is common on every other operating system these days, IBM should deploy DCM in a way, that encrypted connections originating from IBM i to a foreign HTTPS server should work without additional configuration overhead.

So IBM should deliver the following changes:
1. Deliver Digital Certificate Manager with a default *SYSTEM key store.
2. Deliver it in a way, that applications can use it without changing user permissions
3. Optional: Populate the *SYSTEM KDB with default Internet CAs


Use Case:

Improve default general operating security. Use https by default, use ftps by default. Use REST or WebServices APIs.


Idea priority Medium
  • Guest
    Reply
    |     May 6, 2020

    As noted in the prior update, IBM does not intend to provide a solution to this request at this time, so it is being closed.

  • Guest
    Reply
    |     May 15, 2019

    We intend to decline this request however setting to Under Consideration to allow additional dialog.

    IBM i stopped pre-populating new *SYSTEM KDB files with Internet CAs for improved security. What you observe as complexity is someone else's security control. The CAs you are comfortable trusting are not the same as those of someone in another country or industry. The system security administrator must make the decision of who the partition will trust, not DCM.

    DCM GUI has a button to simplify the population of the certificate store with some Internet CAs. An administrator can also set up *SYSTEM on one partition and then use a copy of that KDB to deploy other partitions.

    IBM i 7.4 introduced additional DCM APIs (https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_74/apis/secex1.htm) for automation of some certificate management tasks, though none of the APIs will create *SYSTEM certificate store. Requests for specific functionality made available in a new API would be considered.

  • Guest
    Reply
    |     Jan 20, 2019

    This seems like a step in the right direction to me, as long as the creation process used suitably random entropy so as to make them unique.

    Add to that the ability to created and manage certificates using an IBM i commands and life would be golden.

  • Guest
    Reply
    |     Jan 15, 2019

    You'll always need to create a certificate... and auto creating a self signed certificate has no much benefit in my opinion.

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.