DB2 10.5 for Linux, UNIX, and Windows

SecurityTransportMode IBM data server driver configuration keyword

Sets the communication security type.

Equivalent CLI keyword

Security

Equivalent IBM® data server provider for .NET connection string keyword

Security

IBM data server driver configuration file (db2dsdriver.cfg) syntax

<parameter name="SecurityTransportMode" value="SSL"/>

Default setting:

There is no default setting.

Usage notes:

The SecurityTransportMode keyword specifies whether the TCP/IP with SSL protocols are used in connection to the database server. The default value is an empty string.

When the SecurityTransportMode keyword is set to SSL, you can specify the keystore database with the SSLClientKeystoredb keyword. The keystore database that is specified with the SSLClientKeystoredb keyword can be access using either the password that is set with the SSLClientKeystoreDBPassword keyword or the stash file that is set with the SSLClientKeystash keyword.

If you have not set the SSLClientKeystoredb keyword with the SSLClientKeystoreDBPassword or SSLClientKeyStash keyword, the CLI driver or the IBM Data Server Provider for .NET internally generates a unique default keystore database name and a corresponding keystore database password when application allocates the first environment handle. The unique default keystore database name is based on the process ID of the application that consists of the client_<PID>.kdb format. The keystore database is not created at the time of first environment handle allocation and only the default unique keystore database name is generated.

If you are using the CLI driver and the SecurityTransportMode keyword is set to SSL, the default keystore database is created for each application process ID in the cfg subpath when the following functions are called:

SQLDriverConnect()
SQLConnect()
SQLBrowseConnect()

If you are using the IBM Data Server Provider for .NET and the SecurityTransportMode keyword is set to SSL, the default keystore database is created for each application process ID in the cfg subpath when the database connection is attempted.

For the IBM Data Server Client, IBM Data Server Runtime Client, and IBM database server products, the default keystore database is located in the <instance_path>/cfg/ directory.

For the IBM Data Server Driver Package and IBM Data Server Driver for ODBC and CLI products, the default keystore database is located in the <install_path>/cfg/ directory.

The default keystore database is removed once the application process ID no longer exists on the system. If an abnormal termination of the application process occurs, you must delete the default keystore database to prevent unnecessary disk usage.

In DB2® Version 10.5 Fix Pack 5 and later fix packs, you do not have to obtain the IBM Global Security Kit (GSKit) product separately for establishing SSL connections to a DB2 database server. However, for the certificate-based authentication, you must still download and configure the GSKit product.