Emergency UNIX and Linux Support

Hi,

I'm trying to get a self-signed cert created on AIX 6.1, and it's not cooperating. I run the following command: gsk7cmd -cert -create -db /bin/A_CACertsOnly.kdb -pw blahblah -label testing -dn cn=machinename -expire 1000 -ca true...and get this response:
The function is not supported for cryptographic tokens.

There are other switches for such things a cipher strength and more, but this command pukes on that too. Note that I also know the ikeyman command (java com.ibm.gsk.ikeyman.ikeycmd), and it's doing the same thing.

The command to create the key database, set password and stuff it in a stash file has already been successfully run. Funny thing is, I can create a certreq with these options plus the -size and -file options included, just not a cert. All I'm trying to do is create a self-signed cert and then use that to bind to a domain LDAP server for user authentication, i.e. make this a client of the LDAP domain. I've tried googling my way out, but not much info on this particular issue out there, other than someone else had it too and the forum he was in unfortunately didn't help him.

Thanks in advance for any assistance you may be able to provide.

**UPDATE**
I was able to get the files created using a mix of ikeyman and openssl commands. Now I just have to get the system to supply this cert for connections...is anyone familiar with this??

Thank you!

I recall making one in windows to get my macro containing template accepted quietly. Googling, I see I may have figured this out before. AIX may be using essentially the same code as open_ssl (price is right!):
How to create a self-signed Certificate

www.akadia.com/services/ssh_test_certificate.html
The openssl toolkit is used to generate an RSA Private Key and CSR (Certificate Signing Request). It can also be used to generate self-signed certificates which ...

You've visited this page 2 times. Last visit: 5/31/11

That sounds promising. I can already tell I'm going to want to re-run thru the entire process to make it easier to replicate. I'll go through this as well as ldap client config settings from IBM library first and let ya know.

Thanks for the info!!

It should not be that hard, and then the chain of trust ends at you. It's nice to make one for an org, tied to a trustworthy user and host in the local domain. It might not inspire trust outside, but that is no problem on the intranet.