Generating the Client Certificate

Before generating the client certificate, ensure that you have registered the KMIP client.

You can generate the client certificate using any of the following two options:

• Manual Registration

• Auto Registration

Manual Registration

1. Generate a registration token using the Local Root CA and the profile generated in the previous step.

2. Copy the registration token and go to Registered clients > Add client. Specify the client name and paste the registration token and click Save.

3. Download the resultant client certificate.

4. Move the downloaded client certificate in the working folder (/opt/wallet/KMIP) of DB2 server and rename it to client.crt.

After moving the and renaming the client certificate as mentioned above, add the signed client certificate into local KeyStore. To do so, execute the following command:

/home/<db2 instance user>/sqllib/gskit/bin/gsk8capicmd_64 -cert -receive -db <LOCAL KEYSTOREFILE> -stashed -file <CLIENT CERTIFICATE>

For Example: /home/db2user/sqllib/gskit/bin/gsk8capicmd_64 -cert -receive -db "/opt/wallet/KMIP/clientkeydb.p12" -stashed -file "client.crt"

Auto Registration

1. Copy the CSR generated previously.

2. On the CipherTrust Manager GUI perform the following steps:

   1. Go to CA > Local , click on the Local CA present there.

   2. Click on Upload CSR.

   3. Add a specified name in Display name and paste the content of CSR in the CSR column and select Certificate Purpose as client.

   4. Click on Issue Certificate and save the certificate.

3. Move the downloaded client certificate in the working folder (/opt/wallet/KMIP) of DB2 server and rename it to client.crt.

After moving the and renaming the client certificate as mentioned above, add the signed client certificate into local KeyStore. To do so, execute the following command:

/home/<db2 instance user>/sqllib/gskit/bin/gsk8capicmd_64 -cert -receive -db <LOCAL KEYSTOREFILE> -stashed -file <CLIENT CERTIFICATE>

For Example: /home/db2user/sqllib/gskit/bin/gsk8capicmd_64 -cert -receive -db "/opt/wallet/KMIP/clientkeydb.p12" -stashed -file "client.crt".