MQSeries.net :: View topic - Windows Client V7 to AIX Qmgr v6 via SVRCONN/ssl.

flaufer

Folks,

I'm kinda stuck here...

This is my setup:

Queue manager 6.0.2.1 on AIX (soon to be upgraded to 7.0.1.3) with a cms holding the queue manager's certificate labeled "ibmwebspheremqQMRNAME" (all in small letters) and the keychain (root CA-intermediate CA-online CA). The qmgrs certificate is signed by the online CA.

Connection using a java client (with client certificate in JKS also signed by online-CA) to a SVRCONN channel works well (filter be OU=).

Now I need to connect a Windows MQ Client (V7.0.1.3) Application running under NT AUTHORITY/SYSTEM (Appwatch from BMC) to this particular queue manager.

I've created a kdb, added the three certs from the CA (root-CA, intermediate-CA and online-CA), created a certificate, let the request sign by the online CA and "receive" the certificate into the kdb. This works well.

Now my question is to the required label.

1. I tried some fancy label called ibmwebspheremqappwatch (no appwatch user on either Windows or AIX side). Thought this might work because the Java clients labels also don't match the windows user accounts). No work. First the checking of the CRL failed (http access to the URL mentioned in the certificate DID work). We disabled CRL checking in the mq client ini file. Connection still fails because of the certificate.

2. what label to be used, when the client is running under NT AUTHORIY\SYSTEM ?

3. does the user need to be present on the AIX side, even if we check SSLPEER for OU= ? (MCAUSER will be an existing user with proper OAM privileges).

Felix