First, from my understanding,
The acceptable TLS or SSL version or level that is accepted by mainframe Db2 is specified in the mainframe policy agent (the thing that does the encryption on the mainframe side).
You do NOT specify the TLS version in the Data Studio.
Bsically, when the client connects to the mainframe Db2... the Policy Agent only accepts the TLS versions that it accepts! So if it only allows v1.2 then your client can only use V1.2 They figure it out between themselves.
The policy agent started task is often seen with jobname like PAGENT or *PAGENT*
If you dig in through the control cards... you will see evidence as to what TLS Version is being used or allowed to be used.
> hopefully... you will eventually find a control card with
TTLSConnectionAdvancedParms with has TLSV1.2 with value "On"> the started task job JCL with have DD of name STDEVN DD which points to a PDS member (or a unix file) with a series of ctlcards. If you just dig in and follow the path... one of them will be for "TTLSCONFIG" and that will have the TLS details.
SECOND. from the Data Studio side. The example from Rohan is assuming you have a "truststore" with the certificate(s). I bet that works.... but I think my scenario below is a bit easier.
The mainframe cert is signed by a certificate authority (CA).
One just needs the public cert of the CA and then tell the JDBC driver used by Data Studio about the location of the public cert.
Basically, in the db config driver properties, in the "optional" tab, I specify this property
sslCertLocation=c:\somedirectory\my_ca_public_cert.cerThis avoids the need to create a keystore on my machine.
THIRD, my experience with the different driver types in Data Studio is that if you use
IBM Data Server Driver for JDBC and SQLJ (JDBC 4.) then you must explicitly add optional property
sslConnection=True(essentially, it goes beside the sslCertLocation property)
The only diff with the
IBM Data Server Driver for JDBC and SQLJ (JDBC 4.) using SSL connectivity Defaultis that that this driver type apparently assumes and dynamically adds the property
sslConnection=True= - = - = - =
Some of the above is documented in the IDUG content blog as an article about how I enabled SSL on my Db2. Since I wrote the blog last year... I have continued to learn more about network encryption... but I think it is basically correct!
https://www.idug.org/blogs/brian-laube1/2021/05/05/configuring-db2-for-zos-for-encrypted-networkregards,
Brian
------------------------------
Brian Laube Manulife Financial
Db2 Z DBA (mostly)
------------------------------
Original Message:
Sent: Nov 03, 2022 09:37 AM
From: william giannelli
Subject: TLS setting in Data Studio
thank you very much for the information!
I need to specify TLSv.2
------------------------------
williamgiannelliMe
Original Message:
Sent: Nov 03, 2022 01:07 AM
From: Rohan Pradhan
Subject: TLS setting in Data Studio
Yes, you'll need to specify these in the 'Driver Properties' options tab when specifying the 'Connection Parameters'.
Screenshots for reference:
------------------------------
Rohan Pradhan
Original Message:
Sent: Nov 02, 2022 02:35 PM
From: william giannelli
Subject: TLS setting in Data Studio
Is there a way to specify the TLS setting in Data Studio?
thanks
Bill
------------------------------
williamgiannelliMe
------------------------------