MQSeries.net :: View topic

blovell · Posted: Fri Jul 10, 2015 3:53 am Post subject: SSL Failures

I have been working with a specific client that is unable to establish a SSL connection from their SDR to my RCVR. (Vice Versa works without issue) The signer certificate has been loaded to my key repository and the certificate works when my SDR to their RCVR is started.

Any attempt for them to start their SDR results in a local errors on their side stating:

CSQXRCTL SSL certificate failed remote check. (Not confident what MQ release they use.)

I am currently on MQ 7.0.1.3 (x386 on RHEL 4) and receiving AMQ alerts show:
----- amqrmrsa.c : 524 --------------------------------------------------------
07/10/2015 11:51:21 AM - Process(13217.120491457) User(mqm) Program(amqrmppa)
Host(elsfts01.sl.easylink.com)
AMQ9633: Bad SSL certificate for channel '????'.

EXPLANATION:
A certificate encountered during SSL handshaking is regarded as bad for one of
the following reasons:
(a) it was formatted incorrectly and could not be validated
(b) it was formatted correctly but failed validation against the Certification
Authority (CA) root and other certificates held on the local system
(c) it was found in a Certification Revocation List (CRL) on an LDAP server
(d) a CRL was specified but the CRL could not be found on the LDAP server
(e) an OCSP responder has indicated that it is revoked

The channel is '????'; in some cases its name cannot be determined and so is
shown as '????'. The remote host is '172 (172.24.32.9)'. The channel did not
start.
ACTION:
Check which of the possible causes applies on your system. Correct the error,
and restart the channel.

I am completely at a loss. Why would the SSL authentication work in one direction and not another? We are not specifying any PEER filtering so that cannot be the case.
_________________
Bradley M. Lovell