title: SSL connection to Db2 fails if using SSLClientKeystoredb and SSLClientKeystash keywords. C++
body: <p>I follow the instructions at <a href="https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.sec.doc/doc/c0053514.html" rel="nofollow noreferrer">https://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.sec.doc/doc/c0053514.html</a></p>
  <p>On server I created kdb storage with self-signed certificate:</p>
  <pre><code>gsk8capicmd_64.exe -keydb -create -db server.kdb -stash -genpw
  gsk8capicmd_64.exe -cert -create -db server.kdb -stashed -label server_cert -dn &quot;CN=TestCompany&quot;
  gsk8capicmd_64.exe -cert -extract -db server.kdb -stashed -label server_cert -target server_cert.arm -format ascii
  </code></pre>
  <p>Configured Db2 instance to use SSL:</p>
  <pre><code>db2 &quot;UPDATE DBM CFG USING SSL_SVR_KEYDB &lt;full path to server.kdb&gt;&quot;
  db2 &quot;UPDATE DBM CFG USING SSL_SVR_STASH &lt;full path to server.sth&gt;&quot;
  db2 &quot;UPDATE DBM CFG USING SSL_SVR_LABEL server_cert&quot;
  db2 &quot;UPDATE DBM CFG USING SSL_SVCENAME db2cs_DB2&quot;
  db2set -i &lt;instance_name&gt; DB2COMM=SSL
  db2stop
  db2start
  </code></pre>
  <p>On the client add server_cert.arm to the client storage</p>
  <pre><code>gsk8capicmd_64.exe -keydb -create -db client.kdb -stash -genpw
  gsk8capicmd_64.exe -cert -add -db client.kdb -stashed -label client_cert -file server_cert.arm -format ascii
  </code></pre>
  <p>On server I created database TDB and catalog it on the client machine:</p>
  <pre><code>db2 &quot;CATALOG TCPIP NODE SSLNODE REMOTE ... SERVER ... SECURITY SSL&quot;
  db2 &quot;CATALOG DB TDB AS TDBSSL AT NODE SSLNODE&quot;
  </code></pre>
  <p>Setup SSL_CLNT_KEYDB and SSL_CLNT_STASH to test connection:</p>
  <pre><code>db2 &quot;UPDATE DBM CFG USING SSL_CLNT_KEYDB &lt;full path to client.kdb&gt;&quot;
  db2 &quot;UPDATE DBM CFG USING SSL_CLNT_STASH &lt;full path to client.sth&gt;&quot;
  db2stop
  db2start
  </code></pre>
  <p>And <code>db2 connect to TDBSSL user ... using ...</code> works.</p>
  <p>Return client instance configuration to its original state</p>
  <pre><code>db2 &quot;UPDATE DBM CFG USING SSL_CLNT_KEYDB NULL&quot;
  db2 &quot;UPDATE DBM CFG USING SSL_CLNT_STASH NULL&quot;
  db2stop
  db2start
  </code></pre>
  <p>Next I am trying connect to the TDBSSL from C++ code.
  If I use connection string like <code>DSN=TDBSSL;UID=...;PWD=...;Security=ssl;SSLServerCertificate=&lt;full path to server_cert.arm&gt;&quot;</code> , connection is estableshed</p>
  <p>But if I use SSLClientKeystoredb and SSLClientKeystash keywords
  <code>DSN=TDBSSL;UID=...;PWD=...;Security=ssl;SSLClientKeystoredb=&lt;full path to client.kdb&gt;;SSLClientKeystash=&lt;full path to client.sth&gt;;</code> ,
  connection fails with error</p>
  <pre><code>[IBM][CLI Driver] SQL30081N  A communication error has been detected. Communication protocol being used: &quot;SSL&quot;.  Communication API being used: &quot;SOCKETS&quot;.  Location where the error was detected: &quot;&quot;.  Communication function detecting the error: &quot;sqlccSSLSocketSetup&quot;.  Protocol specific error code(s): &quot;414&quot;, &quot;*&quot;, &quot;*&quot;.  SQLSTATE=08001
  </code></pre>
  <p>Maybe I missed something and the second connection string is wrong or should contain some additional keywords?</p>
  <p>Client db2level</p>
  <pre><code>DB21085I  This instance or install (instance name, where applicable: &quot;DB2&quot;)
  uses &quot;64&quot; bits and DB2 code release &quot;SQL11013&quot; with level identifier
  &quot;0204010F&quot;.
  Informational tokens are &quot;DB2 v11.1.3030.239&quot;, &quot;s1803021700&quot;,
  &quot;DYN1803021700WIN64&quot;, and Fix Pack &quot;3&quot;.
  Product is installed at &quot;C:\PROGRA~1\IBM\SQLLIB&quot; with DB2 Copy Name &quot;DB2COPY1&quot;
  </code></pre>
  <p>Server db2level</p>
  <pre><code>DB21085I  This instance or install (instance name, where applicable: &quot;d111a1&quot;)
  uses &quot;64&quot; bits and DB2 code release &quot;SQL11014&quot; with level identifier
  &quot;0205010F&quot;.
  Informational tokens are &quot;DB2 v11.1.4.4&quot;, &quot;s1808090100&quot;, &quot;DYN1808090100AMD64&quot;,
  and Fix Pack &quot;4&quot;.
  Product is installed at &quot;/opt/ibm/db2/V11.1_01&quot;.
  </code></pre>