| Author |
Message
|
| JonB |
 Posted: Fri Jul 16, 2004 3:31 am Post subject: Connecting two queue manager to Key Ring |
 |
|
Apprentice
Joined: 14 Nov 2002
Posts: 27
Location: Dublin, Ireland
|
Hi,
We have set up SSL on z/OS using ACF2 as the security product. It is possible to connect a second queue manager to use the same key ring?
Also is it possible to get queue managers running on different Z/OS images to use the same key ring?
Thanks
_________________
Jon Barry
IBM Certified System Administrator - WebSphere MQ V5.3
IBM Certified Solution Designer - WebSphere MQ V5.3 |
|
| Back to top |
|
 |
| interactivechannel |
| Posted: Fri Jul 16, 2004 6:36 am Post subject: |
|
|
Voyager
Joined: 20 May 2003
Posts: 94
Location: uk
|
| I imagine it is possible to use the same keyring, but it won't be possible to use the same certificate containing the private key. This is due to the key labelling standard on z/Os. |
|
| Back to top |
|
|
| JonB |
| Posted: Fri Jul 16, 2004 6:43 am Post subject: |
|
|
Apprentice
Joined: 14 Nov 2002
Posts: 27
Location: Dublin, Ireland
|
Thanks for that. I understand that I will need a different cert for each queue manager that I want to have in the Key Ring.
Do you know if I need to give a CHIN the authority to use the key ring?
_________________
Jon Barry
IBM Certified System Administrator - WebSphere MQ V5.3
IBM Certified Solution Designer - WebSphere MQ V5.3 |
|
| Back to top |
|
|
| interactivechannel |
| Posted: Fri Jul 16, 2004 6:54 am Post subject: |
|
|
Voyager
Joined: 20 May 2003
Posts: 94
Location: uk
|
The RACF commands used in the redbook were as follows:
PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(MQXXCHIN) ACCESS(UPDATE)
PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(MQXXCHIN) ACCESS(CONTROL) |
|
| Back to top |
|
|
| pbmsmit |
| Posted: Tue Jul 20, 2004 8:05 am Post subject: |
|
|
Apprentice
Joined: 11 Jul 2003
Posts: 42
Location: Chicago
|
A prerequisite is of course that ACF2 must be shared between the multiple LPARs if you are running the MQManagers on different LPARs. But what is the advantage of sharing the keyring?
BTW Are you using/plannig to use ICSF together with ACF2? We are using CA TopSecret 5.3 (brother of CA ACF2) and cannot use ICSF. Waiting for testing a CA fix to solve this.
_________________
Peter Smit
LaSalle Bank Corporation, member of ABN AMRO NV Group |
|
| Back to top |
|
|
|
|
