To allow OpenEdge client access to a TLS server whose identity you need to verify, you must ensure that the appropriate CA root certificate is available to OpenEdge.

If you have enabled the OpenEdge native trust store, CA root certificates must be installed into the OpenEdge certificate store located in %DLC%\certs on Windows or $DLC/certs on UNIX/Linux (or the path specified by -certstorepath, if configured).

A TLS server can have its identity established from one of two sources:

  • A trusted public CA root certificate, such as those from Symantec or Entrust.
  • A root certificate from an internal CA that you have set up on your own certificate server, or from any other external or public CA.
OpenEdge provides the following command-line utilities to install and manage root certificates in the OpenEdge native certificate store:
  • certutil—Installs, lists, and manages CA root certificates from any CA as entries in the OpenEdge root certificate store. You can also remove certificate store entries using this utility. Removed entries are moved to a backup subdirectory of the root certificate store for future recovery.
    Note: For .NET and Java Open Clients and Web service clients of OpenEdge application servers, you must use other utilities to manage the root certificate stores for those clients and servers. For more information, see Use the Open Client Toolkit.
  • mkhashfile—Provides simple installation of PEM-encoded root certificates into the OpenEdge root certificate store from any CA, but provides no other management functions. Use certutil for additional certificate management.
Note: Before running an OpenEdge command-line utility, set the DLC environment variable to the OpenEdge install directory and the WRKDIR environment variable to your working directory. Running the utility from a Proenv command window sets these variables automatically.