MQSeries.net :: View topic - Problem with 2 way SSL[Resolved]

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » WebSphere Message Broker (ACE) Support » Problem with 2 way SSL[Resolved]

Problem with 2 way SSL[Resolved]

« View previous topic :: View next topic »

Author

Message

mbnewbie

Posted: Fri Oct 04, 2013 1:22 am Post subject: Problem with 2 way SSL[Resolved]

Novice

Joined: 04 Oct 2013
Posts: 19

OS : Win 7
WMB : 8
WMB acts as a server, SOAP UI as client. As the example given in infocenter I have configured the truststore and keystore and registered them with wmb as well (using gsk7cmd). When I send a valid SOAP message on the https url to the broker I get a successful reply in SOAP UI with the SSL Info certificate sent by the broker. Now when I modify the brokerproperties to enable clientAuth I was expecting the messages coming in from SOAP UI to fail because no certificate has been placed in the SOAP UI. However I am still getting successful responses from the broker. I have stopped and started the broker after each change. Can anybody help me to understand where I might be going wrong ? My understanding was that Broker would also validate / authenticate the client(SOAP UI) and since no credentials were presented by the client would reject the request.

Last edited by mbnewbie on Mon Oct 07, 2013 12:56 am; edited 2 times in total

lancelotlinc

Posted: Fri Oct 04, 2013 3:49 am Post subject:

Jedi Knight

Joined: 22 Mar 2010
Posts: 4941
Location: Bloomington, IL USA

Did you run this command ?

Code:

mqsichangeproperties broker_name -b httplistener -o HTTPSConnector -n clientAuth -v true

Code:

mqsichangeproperties broker_name -e execution_group_name -o HTTPSConnector -n clientAuth -v true

_________________
http://leanpub.com/IIB_Tips_and_Tricks
Save $20: Coupon Code: MQSERIES_READER

mbnewbie

Posted: Fri Oct 04, 2013 9:51 pm Post subject:

Novice

Joined: 04 Oct 2013
Posts: 19

already done.................

Code:

C:\Program Files\IBM\MQSI\8.0.0.1>mqsireportproperties MB8BROKER -b httplistener
-o HTTPSConnector -a

HTTPSConnector
uuid='HTTPSConnector'
algorithm='Platform Default'
clientAuth='true'
keystoreFile='Platform Default'
keystorePass='********'
keystoreType='Platform Default'
truststoreFile='Platform Default'
truststorePass='********'
truststoreType='Platform Default'
sslProtocol='Platform Default'
ciphers='Platform Default'
address=''
port=''
allowTrace=''
maxPostSize=''
acceptCount=''
bufferSize=''
compressableMimeTypes=''
compression=''
connectionLinger=''
connectionTimeout=''
maxHttpHeaderSize=''
maxKeepAliveRequests=''
maxSpareThreads=''
maxThreads=''
minSpareThreads=''
noCompressionUserAgents=''
restrictedUserAgents=''
socketBuffer=''
tcpNoDelay=''
enableLookups='false'

dogorsy

Posted: Fri Oct 04, 2013 10:14 pm Post subject:

Knight

Joined: 13 Mar 2013
Posts: 553
Location: Home Office

mbnewbie wrote:

already done.................

Code:

Your answer is very ambiguous. Was it already done, or have you just done it and showing us that it was, indeed already set ?
Sometimes a simple YES or NO is the best answer.
for example:

yes, I have run it.
no. I have not.
no, but I checked the properties and it has already been set by someone else
yes, I have just run it
and then include the output from the reportproperties command.

mbnewbie

Posted: Sat Oct 05, 2013 1:41 am Post subject:

Novice

Joined: 04 Oct 2013
Posts: 19

i had already done it before lancelotlinc commented about it.

mbnewbie

Posted: Sun Oct 06, 2013 3:00 am Post subject:

Novice

Joined: 04 Oct 2013
Posts: 19

i modified my flow by replacing all SOAP nodes with equivalent HTTP nodes with xmlnsc and deployed the modified flow. the broker port and url changed. now when i sent a message from soap ui to this new url i got a socket error. now i configured ssl properties in soap ui with the correct keystore and the response was received. so it seems that there is something to be additionally configured in the soap node beside https. i am working on this now. any input on what additional settings are welcome - i am checking ws security now.

lancelotlinc

Posted: Sun Oct 06, 2013 3:14 am Post subject:

Jedi Knight

Joined: 22 Mar 2010
Posts: 4941
Location: Bloomington, IL USA

mbnewbie wrote:

i modified my flow by replacing all SOAP nodes with equivalent HTTP nodes with xmlnsc and deployed the modified flow. the broker port and url changed. now when i sent a message from soap ui to this new url i got a socket error. now i configured ssl properties in soap ui with the correct keystore and the response was received. so it seems that there is something to be additionally configured in the soap node beside https. i am working on this now. any input what additional settings are welcome - i am checking ws security now.

How is this a solution to the problem ? Are you saying that the SOAP nodes are defective ? Do you think all the other WMB users on the planet abandoned the use of SOAP nodes ?

Why not troubleshoot for root cause than shotgun an incorrect solution ? Have you opened a PMR ?

Did you realize that the same code that manages SSL in HTTP nodes also manages SSL in SOAP nodes ? Changing out the node types did nothing for changing the code that manages SSL.

Did you go to training ? Or are you just shotgunning based on lack of knowledge ?
_________________
http://leanpub.com/IIB_Tips_and_Tricks
Save $20: Coupon Code: MQSERIES_READER

mqjeff

Posted: Sun Oct 06, 2013 9:36 am Post subject:

Grand Master

Joined: 25 Jun 2008
Posts: 17447

lancelotlinc wrote:

Did you realize that the same code that manages SSL in HTTP nodes also manages SSL in SOAP nodes ?

Not necessarily. It depends quite a lot on the version of Broker in question, and then the configuration of the Broker secondarily.

Regardless, mbnewbie - you've avoided the real problem, not solved it. You've then added in more problems, that you won't run into until later - for example, when you suddenly discover that you need to handle WS-Security.

mbnewbie

Posted: Sun Oct 06, 2013 7:25 pm Post subject:

Novice

Joined: 04 Oct 2013
Posts: 19

mqjeff wrote:

lancelotlinc wrote:

Did you realize that the same code that manages SSL in HTTP nodes also manages SSL in SOAP nodes ?

WMB is on default configuration, regarding switching to HTTP nodes - that was just to test/diagnose. My final goal is to make it run on SOAP nodes. I can try doing this whole exercise on V7 broker after setting it up or use another SSL enabled client as there may be a problem in SOAP UI also.

fjb_saper

Posted: Mon Oct 07, 2013 12:29 am Post subject:

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY

I would doubt that there is a problem with SOAP UI.
To make it work with 2way SSL and SOAP nodes you need to set up the right policy to check for the client's key in your truststore.

Have fun

_________________
MQ & Broker admin

mbnewbie

Posted: Mon Oct 07, 2013 12:55 am Post subject:

Novice

Joined: 04 Oct 2013
Posts: 19

Issue resolved after running -------------> mqsichangeproperties MB8BROKER -e default -o ExecutionGroup -n soapNodesUseEmbeddedListener -v false

Thank you all for you help/comments/support.

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » WebSphere Message Broker (ACE) Support » Problem with 2 way SSL[Resolved]

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP