Using APIs to programmatically issue certificates to users other than System i users
Use this information to learn how you can use your local CA to issue private certificates to users without associating the certificate with a System i™ user profile.
In i5/OS® V5R3 or later, there are two new APIs available that you can use to programmatically issue certificates to users other than System i users. In previous releases, when you used your local Certificate Authority (CA) to issue certificates to users, these certificates were automatically associated with their System i user profiles. Consequently, to use the local CA to issue a certificate to a user for client authentication, you had to provide that user with a System i user profile. Also, when users needed to obtain a certificate from a local CA for client authentication, each user had to use Digital Certificate Manager (DCM) to create the needed certificate. Therefore, each user must have a System i user profile on the system that hosts DCM and a valid sign-on to that system.
Having the certificate associated with a user profile has its advantages, especially when internal users are concerned. However, these restrictions and requirements made it less practical to use the local CA to issue user certificates for a large number of users, especially when you do not want those users to have a System i user profile. To avoid providing user profiles to these users, you might require users to pay for a certificate from a well-known CA if you wanted to require certificates for user authentication for your applications.
These two new APIs provide support that allows you to provide an interface for creating user certificates signed by the local CA certificate for any user name. This certificate will not be associated with a user profile. The user does not need to exist on the system that hosts DCM and the user does not need to use DCM to create the certificate.
There are two APIs, one for each of the predominate browser programs, that you can call when using Net.Data® to create a program for issuing certificates to users. The application that you create must provide the Graphical User Interface (GUI) code needed to create the user certificate and to call one of the appropriate API to use the local CA to sign the certificate.
Parent topic:
Creating and operating a local CARelated concepts
Public certificates versus private certificates Digital certificates for user authenticationRelated tasks
Creating and operating a local CA