Home > IT Answers > Security > Validation error importing a digital certific...
Rhoover
25 pts.
Q:
Validation error importing a digital certificate using DCM
iSeries DCM, Digital certificates, issuer
While importing a CA digital certificate into the *SYSTEM store using DCM, we received the following error: "An error occurred during certificate validation. The issuer of the certificate may not be in the certificate store or the issuer may not be enabled." How do we add an issuer to the certificate store?

Software/Hardware used:
iSeries DCM
ASKED: Oct 7 2009  4:09 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
Whatis23
5090 pts.
A:
 RATE THIS ANSWER
0
Click to Vote:
  •   0
  •  0
  • Bookmark and Share
Login to the DCM
Select a Certificate Store (default is *SYSTEM)
Enter password and continue
On the left drop down menu, click on Fast Path
Select Work with CA certificates
This will display all the current CA (Certificate Authority) and their status. You will see entries like VeriSign, RSA, etc. If the one you are using is listed, change the status to ENABLED by clicking on Enable.

If it is not listed, click on Import at the bottom and add the new issuer (Digicert for example)
Last Answered: Oct 7 2009  11:01 PM GMT by Whatis23   5090 pts.
  •   
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Rhoover   25 pts.  |   Oct 8 2009  2:36PM GMT

Thanks for the help but that did not solve it. The certificate we are trying to add (Akamai) says it was issued by GTE, which is in the CA store and enabled. Yet we get the same error indicating the issuer is not in the store. I suspect the certificate is somehow corrupted or the GTE CA certificate is not the correct one. Strangely, this GTE CA certificate, which on the website (UPS) we retrieved it from indicated it was issued by GTE, now after importing it into the DCM indicates it was issued by VeriSign. Thanks again - RHoover

 

Whatis23   5090 pts.  |   Oct 9 2009  6:41PM GMT

Is VeriSign enabled as well in the DCM?
If it is, then then there is a mismatch in the cert.
Double click on the 3 security certs you received to open.
If you’re asked which app to use to open, select Crypto Shell Extensions
Clcik on the Certification Patch tab.
This is where you will see the mismatch names you mentioned.
There is a way to correct it from here but i do not recall how but IBM SERV walked me thru it.

 

Rhoover   25 pts.  |   Oct 9 2009  6:52PM GMT

Thanks again Whatis23. We found the problem was the method used to export the certs from the web site. It was a multi-path cert and we had to view each individual cert before we clicked the COPY button. Once we did that the certs imported without error and display the correct issuer. Thanks again for the help. - RHoover