MQSeries.net :: View topic

raghug · Posted: Thu Apr 17, 2008 8:16 am Post subject: MQ SSL Error

Hi All

I follow below steps But I got error
An error occurred while opening the database file,check for file existence and permission.

20086 - An error occurred while opening files, check for file existence and permissions.

MQ Server: 5.3, sun o/s 5.8, no ssl has been configured before.
MQ : 5.3, running remote on Sun o/s.

Configure the MQ Server
====================
gsk5cmd is used here to create key.kdb (if necessary), create a self assigned certificate, export to a .ARM file.

Let us assume the qmgr is call MQDSMDW01

1. (If necessary) create a key.kdb (crt_kdb.sh) for MQ Server.

/home/victor> cat crt_kdb.sh
export JAVA_HOME=/usr/mqm/ssl/jre
gsk5cmd -keydb -create -db key.kdb -pw iss55 -type cms -expire 365 -stash

2. create a self assigned certifcate in key.kdb.

/home/victor> cat crt_cert.sh
export JAVA_HOME=/usr/mqm/ssl/jre
gsk5cmd -cert -create -db key.kdb -pw changeit -label ibmwebspheremqmqdsmdw02 -dn CN=AUGUSTA,O=CCE,C=US -expire 365 -size 1024 -x509version 3

note the fixed "ibmwebspheremq<qmgr in lower case>".
qmgr Foo becomes "foo" here.

3. Export the ibmwebspheremqfoo to .arm format (mqdsmdw01arm)

/home/victor> cat ext_cert.sh
export JAVA_HOME=/usr/mqm/ssl/jre
gsk6cmd -cert -extract -db key.kdb -pw changeit -label ibmwebspheremqfoo -target mqdsmdw01arm -format ascii

4. log on as mqm, copy the key.kdb,key.sth to /var/mqm/qmgrs/MQDSMDW02/ssl.

5. log on as mqm, turn on SSL for the channel "MQDSMDW01CLIENT" , only SVRCONN is needed. Here is how to turn on/off the SSL on the fly.

cat ssl.mqsc | runmqsc FOO
$ cat ssl.mqsc
alter channel(MQDSMDW01CLIENT) CHLTYPE(SVRCONN) SSLCIPH(TRIPLE_DES_SHA_US) SSLCAUTH(OPTIONAL)

Optionally, to turn the SSL off,

cat nossl.mqsc | runmqsc FOO

$ cat nossl.mqsc
alter channel(MQDSMDW01CLIENT) CHLTYPE(SVRCONN) SSLCIPH('')

Configure MQ base java.
========================

1. use keytool -keystore cacerts -import -file MQDSMDW01arm

2. In the code, make sure this line runs.
MQEnvironment.sslCipherSuite="SSL_RSA_WITH_3DES_EDE_CBC_SHA";
In my case, I only set the CipherSuite when some property "sslEnabled" is true from a XML file. In this way, I can turn the SSL on/off from the client to match what is on the MQ server side.

and one more thing I did not understand where we create .kst file

Thanks
Raghu