IBM Power Ideas Portal
This portal is to open public enhancement requests against IBM Power Systems products, including IBM i. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).
Shape the future of IBM!
We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:
Search existing ideas
Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,
Post your ideas
Post an idea.
Get feedback from the IBM team and other customers to refine your idea.
Follow the idea through the IBM Ideas process.
Specific links you will want to bookmark for future use
Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.
IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.
ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.
The CAAC has reviewed this IBM Idea and recommends that IBM view this as a high priority Idea that is important to be addressed.
We agree that bringing down a server to update a certificate is a significant problem.
Background: The COMMON Americas Advisory Council (CAAC) members have a broad range of experience in working with small and medium-sized IBM i customers. CAAC has a key role in working with IBM i development to help assess the value and impact of individual IBM Ideas on the broader IBM i community and has therefore reviewed your Idea.
For more information about CAAC, see www.common.org/caac
Carmelita Ruvalcaba - CAAC Program Manager
I think you need to specify which server or service you think IBM needs to implement this for. Many TCP server/services already supports this.
We are at IBM i 7.5 and the following servers/services picks up the new certificate once you re-assigned the application definition in DCM without having to restart them: FTP, DDM/DRDA (448), Telnet (992), IBM i Host Servers (9470 - 9476)
IWS servers will start to use the new certificate once you have assigned a new one in Navigator for i or the IBM i HTTP Web Administration GUI.
IBM i Http Web Server have a Restart function that basically works as a reload function, can be done in both the Navigator for i or the IBM i HTTP Web Administration GUI. I also think this can be done with CL command as well but have not actually tried it: STRTCPSVR SERVER(*HTTP) RESTART(*HTTP) HTTPSVR(<my_web_server>)
MQ certificate stored in DCM can also be changed on the fly, but requires an MQ CLI command for every MQ manager to be executed: REFRESH SECURITY TYPE(SSL)
Some of the ADMIN servers (Liberty application servers) also picks up the certificate instantly without having to end and start, but not all of them. So you probably need to End and Start the *ADMIN servers. Could be a design feature as DCM and Navigator for i run under them.
I do not know how custom application servers based on liberty works though.
*DIRSVR (LDAP) requires a complete restart (end/start) though, would be nice if that service also could start to use a new certificate having to shut it down.