#!/bin/bash

SERVER=mydbserver
PASSWORD=mypassword
LABEL=SelfSigned
HOST=myhost.mydomain.com
COMPANY=MyCompany

DB2DIR=/opt/ibm/db2/V11.5
GSK=$DB2DIR/gskit/bin; export GSK
SSLDIR=$HOME/ssl
SSLPORT=50448

# Create the keystore
$GSK/gsk8capicmd_64 -keydb -create \
-db "$SSLDIR/$SERVER.kdb" -pw "$PASSWORD" -stash

# Create the certificate
$GSK/gsk8capicmd_64 -cert -create \
-db "$SSLDIR/$SERVER.kdb" -pw "$PASSWORD" \
-label "$LABEL" \
-dn \ "CN=$HOST,O=$COMPANY,OU=CustomerSupport,L=California,ST=ON,C=CA" \ -size 2048 -sigalg SHA256_WITH_RSA

# Export the certificate for use by the client
$GSK/gsk8capicmd_64 -cert -extract -db "$SSLDIR/$SERVER.kdb" \
-pw "$PASSWORD" -label "$LABEL" \
-target "$SSLDIR/$SERVER.arm" -format ascii -fips

# Update DB2 LUW server
db2 update dbm cfg using SSL_SVR_KEYDB "$SSLDIR/$SERVER.kdb"
db2 update dbm cfg using SSL_SVR_LABEL $LABEL
db2 update dbm cfg using SSL_SVR_STASH "$SSLDIR/$SERVER.sth"
db2 update dbm cfg using SSL_SVCENAME $SSLPORT
db2set DB2COMM=SSL,TCPIP

# Optional - enforce TLS 1.2
db2 update dbm cfg using ssl_versions TLSv12

# restart Db2
db2stop
db2start
