This file contains information to help resolve SSL configuration issues.

Use the full hostname when connecting:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't rely on localhost as a hostname, and be sure to specify the SSL port
when invoking the DataImport Command.
Use the -host and -port command line arguments to pass correct values:
    -host adminib-3qtcvh1 -port 9443

To resolve a SSLSocketFactory error message:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You may encounter a SSLSocketFactory error message if you are using the JVM 
shipped with WebSphere Application Server.

The workaround is to override some properties using a custom properties file:
1) Create a text file named DataImport.java.security.properties
2) Insert the following two lines as the file contents:
    ssl.SocketFactory.provider=
    ssl.ServerSocketFactory.provider=
3) Add a -Djava.security.properties=<filepath> argument to the JVM:
    Ex: -Djava.security.properties=/SomeDir/DataImport.java.security.properties
    
To resolve a "peer not authenticated" error message:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You may encounter a "peer not authenticated" message if the WebSphere 
Application Server hosting the Data Import Engine uses a self signed SSL 
certificate.

The workaround is to extract the WebSphere Application Server certificate; add
the extracted certificate to a new certificate store; and then tell the JVM 
executing the Data Import command line to use the new certificate store.

1) On the WebSphere console, go to Security -> 
  SSL certificate and key management -> 
  Key stores and certificates -> 
  NodeDefaultKeyStore > 
  Personal certificates.
2) Select the default, and extract the certificate to a file 'extracted_cert'.
3) WebSphere will place the 'extracted_cert' file into the 
   WAS_ROOT\profiles\AppSrv1\etc directory 
4) Copy 'extracted_cert' to a working directory 'c:\cert'
5) Copy the WebSphere cacerts file into the 'c:\cert' working directory.
   The cacerts file is located in the WAS_ROOT\java\jre\lib\security directory.
6) Use the ikeyman to open your copy of the cacerts file.
   a) The ikeyman program is supplied with WebSphere Application Server. The
      file is located in the WAS_ROOT\bin directory.
   b) Start the ikeyman program, click on the 'open' icon
   c) Change the 'Key database type' to JKS in the open file dialog
   d) Browse to the 'c:\cert' working directory and open the cacerts copy, the
      default password is 'changeit'. Note that the cacerts file does not have
      an extension, so change the "Files of Type" dropdown to "All Files".
   f) Select Signer certificates from the drop down under "key database content"
   g) Select the add button, and then select the 'extracted_cert' file that you 
      extracted the certificate into in step 4 above. Change "Files of Type" to
      "All Files" so the 'extracted_cert' file is visible.
   h) Exit the ikeyman program. The ikeyman file automatically saves the file.
7) Modify the batch/sh file that starts DataImport to use the new cacerts file.
   Add a -Djavax.net.ssl.trustStore=<filepath> argument to the JVM:
   -Djavax.net.ssl.trustStore=c:\cert\cacerts

If you are still having problems:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You can use the -Djavax.net.debug=all JVM option to dump out much more 
informative information about the ssl negotiation than you get with the basic 
exception information.
