For SSL renewal procedure in Db2 LUW , DO i need to create CSR request for each instance residing in same server?

Question

I am trying to renew my SSL certs . Stuck here if we need to have create a Certificate Signing Request for each instance residing on the same server and send it to CA who will provide us the certificates .

Answer 1

There is no reason to create a different CSR for each instance on a host. A non-wildcard SSL Certificate is tied to a particular server, so you would typically use the same certificate for all instances.

With multiple instances, you can create a CSR for the first instance to send to the CA, then receive the certificate into that instance’s keystore. As long as you don’t have different contents for each instance’s SSL keystore, you can simply copy the files that make up one instance’s keystore to each other instance’s keystore.

Some might suggest having a single keystore that all Db2 instances use, but this creates other problems for maintaining security (as the keystore should only be accessible by the instance owner). It might be possible to do this with ACLs, but creating that complexity may outweigh the benefit you’d get from having a separate keystores for each instance.