MQSeries.net :: View topic - Windows Schannel Reference Guide and SSL?

hguapluas · Posted: Mon Aug 16, 2004 5:41 am Post subject:

I'm working on Windows MQ5.3 CSD6 and building test implementation of SSL secured channels. One of the errors I am getting is to reference the Schannel Reference Guide. Where is this located? I can't find it and know it's been mentioned in other threads by title, but not by location.

Also, in the FDC files, I am getting specific messages but can't find information to help point me in the right direction. Can anybody help?

I created two private certificates using an Enterprise CA authority and imported both into both systems. Assigned appropriate key to each system and set CipherSpec on both S/R channels to match.

Edited parts of FDCs below:

| Major Errorcode :- rrcE_SSL_SSPI_ERROR_HANDSHAKING
| Minor Errorcode :- OK
| Probe Type :- MSGAMQ9699
| Probe Severity :- 2
| Probe Description :- AMQ9699: An unknown error occurred during an SSL security call during SSL handshaking.
| FDCSequenceNumber :- 35
| Comment1 :- ????
| Comment2 :- AcceptSecurityContext
| Comment3 :- 0x80090304 (The Local Security Authority cannot be contacted )
...
--------{ cciTcpSslLoadCertificateFromStore
---------{ cciTcpSslOpenDefaultStore
----------{ cciTcpSslGetDefaultStoreFile
-----------{ cciSslEnterCriticalSection
-----------} cciSslEnterCriticalSection rc=Unknown(1)
-----------{ cciSslLeaveCriticalSection
-----------} cciSslLeaveCriticalSection rc=Unknown(1)
----------} cciTcpSslGetDefaultStoreFile rc=OK
----------{
----------} rc=Unknown(1)
---------} cciTcpSslOpenDefaultStore rc=OK
---------{ cciTcpSslSerialNumberToStr
---------} cciTcpSslSerialNumberToStr rc=OK
--------} cciTcpSslLoadCertificateFromStore rc=OK
-------} cciTcpSslGetQueueManagerCertificate rc=OK
------} cciTcpSslGetCertificate rc=OK
------{ cciTcpSslInitCredentialData
------} cciTcpSslInitCredentialData rc=OK
------{ cciTcpSslAcquireCredentialsHandle
------} cciTcpSslAcquireCredentialsHandle rc=OK
------{ cciTcpSslSetSecurityContextAttr
------} cciTcpSslSetSecurityContextAttr rc=OK
------{ cciTcpSslPerformServerHandshake
-------{ ccxAllocMem
-------} ccxAllocMem rc=OK
-------{ cciTcpSslInitializeSecurityContext
-------} cciTcpSslInitializeSecurityContext rc=OK
-------{ cciTcpSend
--------{ send
--------} send rc=Unknown(14EE)
-------} cciTcpSend rc=OK
-------{ cciTcpReceive
--------{ recv
--------} recv rc=Unknown(655)
-------} cciTcpReceive rc=OK
-------{ cciTcpSslInitializeSecurityContext
-------} cciTcpSslInitializeSecurityContext rc=OK
-------{ cciSslSetInserts
-------} cciSslSetInserts rc=OK
-------{ xcsFFST

This represents the FDC for one of the channels. The FDC for the other channel is the same except for the following info:

| Comment1 :- CH2
| Comment2 :- QueryContextAttributes
| Comment3 :- 0x80090301 (The handle specified is invalid )

The channels do work when SSL is not enabled so I am guessing I am missing some configuration issue or maybe the problem is starting at the OS level?

Any assistance in being pointed in the right direction so I can identify the specific problem(s) and answer(s) would be appreciated.

(I have read the SSL tutorial, used it as my guide and also gone through most of the SSL threads at least once or twice. The Redbooks and Guides I have are not helping much either.)

Cheers