IBM i uses certificates for various functions, and certificates will expire. I wanted to find a way where I could check the certificate store for any certificates that would be expiring soon. Whatever method I wanted needed to be simple so that I could move to other partitions too.
Fortunately, there is a SQL Table Function that will give me this information, CERTIFICATE_INFO. It has two parameters:
- CERTIFICATE_STORE_PASSWORD: Password for the certificate store. Rather than providing a password I can use the value '*NOPWD', which will retrieve the certificate password from the stashed password file. If a password is used it is recommended it is passed as a variable, so that people cannot see what it is.
- CERTIFICATE_STORE: The name of the certificate store. There are three special values that can be used as well:
- *OBJECTSIGNING: The object signing certificate store
- *SIGNATUREVERIFICATION: The signature verification certificate store
- *SYSTEM: The system certificate store. This is the default value the certificate store parameter is not used
To use this Table Function you must have *ALLOBJ and *SECADM authority.
Regular readers know that I always recommend if this is the first time you are using this Table Function you want to see all the columns. To do that I would use the following statement: