| Author |
Message
|
| euphoria |
 Posted: Wed May 24, 2006 10:00 am Post subject: add vs receive certificates SSL |
 |
|
Acolyte
Joined: 08 Feb 2004
Posts: 51
|
Created Key Database for Qmgr A and QmgrB.
Created certificates and extracted them.
Exchanged the certificates (Ftpied-ascii).
Added the certificate of QMGR B to QMGR A and vice versa.
Created sdr and rcvr chl pair with SSLCIPH attribute.(2-way communication)
Channnels started fine and was able to send messages.I see the SSLPEER attribute populated with DN. I Guess i have SSL enabled the channels. Correct me if i am wrong
Question 1: SSLPEER attribute of both sdr and rcvr channel shows the DN created for the qmgr. (should the reciver cahnnel on A show DN name of certificate created on B ?)
Question2. I did not recieve the certificates into the key repositories of any of the queue managers. Is this required?. The docs show how to add and how to recieve certificates. but when do we have to add a certificate and when do we have to recieve the certificate.
This is in Unix MQ 5.3 CSD11 Env
any input is greatly appreciated |
|
| Back to top |
|
 |
| vennela |
| Posted: Wed May 24, 2006 10:48 am Post subject: |
|
|
Jedi Knight
Joined: 11 Aug 2002
Posts: 4055
Location: Hyderabad, India
|
Adding and receiving is for self signed and CA signed respectively I think.
| Quote: |
| Question 1: SSLPEER attribute of both sdr and rcvr channel shows the DN created for the qmgr. (should the reciver cahnnel on A show DN name of certificate created on B ?) |
I think I don't understand, but probably you are OK.
Iy you have done a two way and used self signed certs, then one SDR-RCVR pair should show the DN values created for one QMGR and the other pair should show the DN values created for the other QMGR
2: If you are using self signed I don't think you need to receive anything I think. |
|
| Back to top |
|
|
| euphoria |
| Posted: Wed May 24, 2006 11:10 am Post subject: |
|
|
Acolyte
Joined: 08 Feb 2004
Posts: 51
|
No CA certificates involved.
Channel status on QMGR A. shows the following
Sender channel (to B) has SSLPEER= DN of certificate created on B
Receiver channel (from B) has SSLPEER= DN of certificate created on B.
I guess that is the way it should be |
|
| Back to top |
|
|
| vennela |
| Posted: Wed May 24, 2006 12:21 pm Post subject: |
|
|
Jedi Knight
Joined: 11 Aug 2002
Posts: 4055
Location: Hyderabad, India
|
|
| Back to top |
|
|
| Anirud |
| Posted: Thu May 25, 2006 10:00 am Post subject: |
|
|
Master
Joined: 12 Feb 2004
Posts: 285
Location: Vermont
|
| euphoria wrote: |
No CA certificates involved.
Channel status on QMGR A. shows the following
Sender channel (to B) has SSLPEER= DN of certificate created on B
Receiver channel (from B) has SSLPEER= DN of certificate created on B.
I guess that is the way it should be |
That's how it works. It will be the other way around on QMGR B (you will see the DN values of QMGR A).
Also, you can specify SSLPEER value (DN used on the selfsigned certificate) on the channel definition, for added security. By doing so, the channel will only start if it receives a request with the specified DN values.
Hope I'm not confusing you. You are good to go as is !!! |
|
| Back to top |
|
|
| euphoria |
| Posted: Sun May 28, 2006 10:50 am Post subject: |
|
|
Acolyte
Joined: 08 Feb 2004
Posts: 51
|
|
| Back to top |
|
|
|
|
