MQSeries.net :: View topic - SSL

max power · Posted: Tue Oct 23, 2007 6:06 am Post subject:

I am trying to use SSL for the first time and am trying to connect 2 v6 Windows QMgr's (on the same laptop) using Self Signed Certificates within the iKeyMan Gui (strmqikm)
These are the steps I'm taking.....
On the Sending QMgr:
1. Create key database file (C:\Program Files\IBM\Websphere MQ\Qmgrs\SSLQM1\ssl\key.kdb)
2. Create New Self Signed Certificate. label=ibmwebspheremqsslqm1, Common Name=SSLQM1, O=Test, OU=Other, C=GB
3. Extract this certificate to file (C:\Program Files\IBM\Websphere MQ\Qmgrs\SSLQM1\ssl\cert.arm)

On the Receiving Qmgr:
1. Create key database file (C:\Program Files\IBM\Websphere MQ\Qmgrs\SSLQM2\ssl\key.kdb)
2. In 'Signer Certificates', Add certificate from file (using above cert.arm file)
3. Receiver Channel has Authentication set to 'Optional'

Both SDR/RCVR channels have SSL encryption set to RC4_SHA_US

When I start the SDR channel from SSLQM1 to SSLQM2, the channel goes in to a 'Retrying' state with the following error in the log:

23/10/2007 14:42:37 - Process(948.1) User(MUSR_MQADMIN) Program(runmqchl.exe)
AMQ9633: Bad SSL certificate for channel 'SSLQM1.SSLQM2'.

EXPLANATION:
A certificate encountered during SSL handshaking is regarded as bad for one of
the following reasons:
(a) it was formatted incorrectly and could not be validated, or
(b) it was formatted correctly but failed validation against the Certification
Authority (CA) root and other certificates held on the local system, or
(c) it was found in a Certification Revocation List (CRL) on an LDAP server.
(d) a CRL was specified but the CRL could not be found on the LDAP server.

The channel is 'SSLQM1.SSLQM2'; in some cases its name cannot be determined and
so is shown as '????'. The channel did not start.
ACTION:
Check which of the three possible causes applies on your system. Correct the
error, and restart the channel.

I'm sure I'm missing a step (or steps) but I can't for the life of me think what it is. I've looked through the documentation and I'm not finding anything that can help me.