MQSeries.net :: View topic

alphamale · Posted: Mon Jul 14, 2008 4:42 am Post subject: SSL problem

Hi

I have two queue managers using SSL to secure a SDR/RCVR channel pair (one QM on AIX, the other on HP-UX)

The SDR channel from QMA to QMB has SSLCIPH set, SSLPEER set, and SSLCAUTH to 'REQUIRED' at both ends. The channel starts successfully.

The SDR channel from QMB to QMA has only SSLCIPH set at both ends (same value) and the channel will not start - get AMQ9665 reported at QMB, and AMQ9633 reported at QMA.

The AMQ9633 implies there is something wrong with a certificate (the CRL option doesn't apply), but doesn't indicate whose certificate - I assume it may be QMA's as QMB is the client and it shouldn't be sending its certificate (SSLCAUTH is OPTIONAL).

However, on the QMA to QMB channel, SSLCAUTH was REQUIRED at both ends, so each QMgr will have authenticated with each other, implying that both certificates could be found/exchanged (they even validated each others Distinguised Name info).

So on the QMB to QMA channel, does anyone have any ideas which certificate it might have an issue with, and why this should be so when the other channel works ok ?