| Author |
Message
|
| blovell |
 Posted: Mon Sep 13, 2010 4:53 am Post subject: GSK6IKM |
 |
|
Acolyte
Joined: 08 Feb 2006
Posts: 63
Location: Alpharetta, GA
|
I am in the process of migrating my clients to mq v 7.0.0.1, I have one client remaining on the older MQ 5.3 CSD 07. The problem is my current personnal cert is set to expire in Dec. and after this i can only get 2048 certs., the GSK6IKM only seems to allow me to create 1024. Do any of the fixpacks to CSD14 update this? Is there anyway I can up this limit temporarily until I can get this customer moved.
As indicated MQ 5.3 CSD07, Solaris 5.8
_________________
Bradley M. Lovell |
|
| Back to top |
|
 |
| exerk |
| Posted: Mon Sep 13, 2010 5:59 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
I'm not that up on WMQ V5.3 any more, certainly not at that CSD level, and wasn't aware that iKeyMan restricts the key length. Only suggestion I have is trying the following:
| Code: |
export JAVA_HOME=/opt/mqm/ssl
gsk6cmd -certreq -create -db <path>/<key store>.kdb -pw <password> -label ibmwebspheremq<qmname> -dn 'CN=<?>,O=<?>,OU=<?>,L=<?>,ST=<?>,C=<?>' -size 2048 -file <path>/<key store>.arm |
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| blovell |
| Posted: Mon Sep 13, 2010 7:33 am Post subject: |
|
|
Acolyte
Joined: 08 Feb 2006
Posts: 63
Location: Alpharetta, GA
|
Unfortunately when running my gsk6cmd it tells me the only valid size is 1024, or 512... (Yikes)
-certreq -create [-db <name>] [-crypto <module name> [-tokenlabel <token label>]|[-relativeSlotNumber <slot_number>]] [-pw <passwd>] -label <label> -dn <dist name> [-size <1024 | 512>] -file <name>
_________________
Bradley M. Lovell |
|
| Back to top |
|
|
| exerk |
| Posted: Mon Sep 13, 2010 7:36 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
Then my only other suggestion is to recreate the key store and request 'off-box', receive the certificate, and transport the key store file(s) to the server - and see if it works 
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| blovell |
| Posted: Mon Sep 20, 2010 10:13 am Post subject: |
|
|
Acolyte
Joined: 08 Feb 2006
Posts: 63
Location: Alpharetta, GA
|
Does anybody know which MQ version of GSK tools first started allowing 2048 certs??????? I am loading the CSD014 to 5.3 in the hopes it will allow it.
_________________
Bradley M. Lovell |
|
| Back to top |
|
|
| mqjeff |
| Posted: Mon Sep 20, 2010 10:29 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
This seems like a darned good reason to force an upgrade to MQ v6.
"Sorry boss, our new security requirements make it necessary that we stop using unsupported software".
You could also attempt to generate the cert request and receive the cert in a v6 environment, as the esteemable exerk suggested, and then move the cert store to the v5.3 keystore location.
And then test it and find out of if MQ v5.3 itself is unable to handle a 2048 keylength - in addition to gskit v6 not being able to handle it. |
|
| Back to top |
|
|
| blovell |
| Posted: Mon Sep 20, 2010 11:00 am Post subject: |
|
|
Acolyte
Joined: 08 Feb 2006
Posts: 63
Location: Alpharetta, GA
|
We have upgraded to 7.0.0.1, I just have a remaining client that cannot move until the first of the year.. Unfortunately that isn't enough time as my current cert expires in Dec., and I am going to have a heck of a time finding a CA to give me a 1024. 
_________________
Bradley M. Lovell |
|
| Back to top |
|
|
| exerk |
| Posted: Mon Sep 20, 2010 11:05 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
OpenSSL - create your own CA and use it to sign the cert request for your client. It means a sign-off by your security department, or better still, get them to do it. It's only an interim measure after all.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
|
|
