I am trying to renew my SSL certs . Stuck here if we need to have create a Certificate Signing Request for each instance residing on the same server and send it to CA who will provide us the certificates .

  • Do you have multiple certificates on your server now? Find the certificates that are required for SSL and you will have your answer. The[ documentation for SSL in DB2](ibm.com/support/knowledgecenter/SSEPGG_11.1.0/…) provides some examples on how to retrieve the current certificates.
    – John K. N.
    Commented May 4, 2020 at 9:58
  • Certificates found * default, - personal, ! trusted, # secret key ! entrust_g2_ca ! entrust_l1k ! entrust_l1k_chain_root - plnckdsv0008
    – Ishita
    Commented May 4, 2020 at 10:09
  • Could you please [edt] your post and add the details to your question instead of in the comments? Comments are harder to read. If you enclose the output in triple back ticks ``` or possibly a greater than character with an additional space > then it might be even more legible. Thanks.
    – John K. N.
    Commented May 4, 2020 at 11:02

1 Answer 1


There is no reason to create a different CSR for each instance on a host. A non-wildcard SSL Certificate is tied to a particular server, so you would typically use the same certificate for all instances.

With multiple instances, you can create a CSR for the first instance to send to the CA, then receive the certificate into that instance’s keystore. As long as you don’t have different contents for each instance’s SSL keystore, you can simply copy the files that make up one instance’s keystore to each other instance’s keystore.

Some might suggest having a single keystore that all Db2 instances use, but this creates other problems for maintaining security (as the keystore should only be accessible by the instance owner). It might be possible to do this with ACLs, but creating that complexity may outweigh the benefit you’d get from having a separate keystores for each instance.

  • Thank You so much for answering . IN CSR request can we use same label or different label could be used . After importing the signed certificate into Db2 server ,What steps we need to follow on db2 clients ?
    – Ishita
    Commented Jun 1, 2020 at 13:35
  • ..Can you help me answering this ?
    – Ishita
    Commented Jun 9, 2020 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.