| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Processing p7b files |
« View previous topic :: View next topic » |
| Author |
Message
|
| kordi |
 Posted: Wed Oct 28, 2015 2:06 am Post subject: Processing p7b files |
 |
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
Hi,
I have a task to renew certificates on countless number of servers. I wrote a nice perl script to help me create CSR (checking label of personal certificate, checking CN of certificate, deleting old certificate from kdb and creating CSR using these information).
Now, I got p7b file from signing authority. I would like to add personal certificate along with CA certs from p7b.
This doesn't not work, runmqckm does not support pkcs7: http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_7.5.0/com.ibm.mq.sec.doc/q012870_.htm
however runmqakm does. The problem is that first I have to list all personal and CA certs and having these information receive/add them to kdb. But I don't know how to do that. When I want to list them all, I receive below error.
Anyone have any idea how can I resolve this?
| Code: |
PS D:> runmqakm -cert -list -db certs.p7b -type pkcs7
5724-H72 (C) Copyright IBM Corp. 1994, 2011. ALL RIGHTS RESERVED.
CTGSK3046W The key file ".certsp7b" could not be imported.
CTGSK2119W The input data is not valid PKCS12 data.
-Command usage-
-list Required <all | personal | ca>
-expiry Optional
-db | -crypto Required
-tokenlabel Required if -crypto present
-pw Optional
-type Optional <cms | kdb | pkcs12 | p12>
-secondarydb Optional if -crypto present
-secondarydbpw Optional if -secondarydb present
-secondarydbtype Optional if -secondarydb present |
|
|
| Back to top |
|
 |
| mqjeff |
| Posted: Wed Oct 28, 2015 4:40 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
... you might look at directly using gskit or openssl to list the certs, and then use runmqakm to insert the needed ones. Or, again, gskit/openssl.
_________________
chmod -R ugo-wx / |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Wed Oct 28, 2015 4:49 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Looks like you're confused. I did not see any support for pkcs7 for either runmqckm or runmqakm...
Both support pkcs12 though. Open SSL might be able to do the conversion from pkcs7 for you?
If you have the corresponding java libraries you can add a new provider (pkcs7) to ikman (strmqikm)...
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| kordi |
| Posted: Wed Oct 28, 2015 8:30 am Post subject: |
|
|
Centurion
Joined: 28 May 2012
Posts: 146
Location: PL
|
Yeah, this is pretty confusing, IBM claims runmqckm supports p7b but in fact it doesn't. Looks like gsk doesn't either: http://www-01.ibm.com/support/docview.wss?uid=swg21452440
I think openssl is a solution, but it extracts certs from p7b to a single file. I have to process it somehow.
Thanks guys. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
