MQSeries.net :: View topic

rickwatsonb · Posted: Wed Aug 13, 2014 7:36 am Post subject:

Hi,

I am trying to setup MCA Interception between a MQ 7.5 server with MQ AMS (Linux) and a non-IBM JRE JMS application on Solaris using a MQ 7.1.0.2 Client (no AMS installed).

I have two-way SSL working, but after adding the MCA Interception keystore I get AMQ9008, followed by AMQ9012.

The basic details are shown below but I am not sure where the configuration is in error, or if I missed a step. I did not include all the info for the two-way SSL setup since that is working.

08/05/14 13:59:34 - Process(10560.13) User(mqm) Program(amqrmppa)
Host(EXP) Installation(Installation1)
VRMF(7.5.0.2) QMgr(BATCH.SSL.MCAINT)

AMQ9008: Cannot acquire the certificate for the label:
ibmwebspheremqbatch_user_two_way_ssl_v1 in the keystore file
/var/mqm/.mqs/mqm_keystore. GSKit ACME GSS minor reason is 58.

EXPLANATION:
WebSphere MQ security policy interceptor was unable to read the certificate for
the given label from keystore.
ACTION:
Make sure the label is correctly set as the cms.certificate entry of the
configuration file. Check if the keystore contains the certificate for the
given label.
----- smqodida.c : 778 --------------------------------------------------------
08/05/14 13:59:34 - Process(10560.13) User(mqm) Program(amqrmppa)
Host(EXP) Installation(Installation1)
VRMF(7.5.0.2) QMgr(BATCH.SSL.MCAINT)

AMQ9012: The WebSphere MQ security policy interceptor could not acquire the
public key credential.

EXPLANATION:
The WebSphere MQ security policy interceptor could not perform a public key
infrastructure (PKI) login.
ACTION:
Check the error messages related to acquiring public key credentials to
determine the cause of the failure. Check whether user has the permission to
read the kdb and stash files and verify whether the kdb file contains a
certificate with the label specified. Finally, check whether the certificate
has not expired.

MQ Client 7.1.0.2 non-IBM JRE
.jks Keystore for TWO-WAY SSL (works):
(1) Batch certificate (-label ibmwebspheremqbatch_user_two_way_ssl_v1)
(2) MQ queue manager certificate

MQ Server 7.5.0.2 with AMS â€“ two separate keystores

(A) TWO-WAY SSL Keystore: (/var/mqm/qmgrs/<queue manager>/ssl):
(1) MQ Queue manager certificate
(2) Batch certificate (-label ibmwebspheremqbatch_user_two_way_ssl_v1)

mqm@EXP:/var/mqm/qmgrs/BATCH1044SSL1044MCAINT/ssl> ll
total 36
-rw-r--r-- 1 mqm mqm 88 Jul 22 16:28 BATCH.SSL.MCAINT.crl
-rw-r--r-- 1 mqm mqm 10088 Jul 22 16:34 BATCH.SSL.MCAINT.kdb
-rw-r--r-- 1 mqm mqm 88 Jul 22 16:28 BATCH.SSL.MCAINT.rdb
-rw-r--r-- 1 mqm mqm 129 Jul 22 16:28 BATCH.SSL.MCAINT.sth

(B) MQ AMS MCA Interception Keystore (/var/mqm/.mqs)
(1) Batch certificate (-label ibmwebspheremqbatch_user_two_way_ssl_v1)

mqm@EXP:/var/mqm/.mqs> ll
total 24
-rw-r--r-- 1 mqm mqm 127 Aug 7 10:20 keystore.conf
-rw-r--r-- 1 mqm mqm 88 Jul 29 09:56 mqm_keystore.crl
-rw-r--r-- 1 mqm mqm 5088 Jul 29 10:05 mqm_keystore.kdb
-rw-r--r-- 1 mqm mqm 88 Jul 29 09:56 mqm_keystore.rdb
-rw-r--r-- 1 mqm mqm 129 Jul 29 09:56 mqm_keystore.sth

mqm@EXP:/var/mqm/.mqs> more keystore.conf
cms.keystore = /var/mqm/.mqs/mqm_keystore
cms.certificate.channel.BATCH.SSL.CHANNEL = ibmwebspheremqbatch_user_two_way_ssl_v1

Other steps:
- Authorize the users to connect to the queue manager and to work with the queue
o setmqaut -m BATCH.SSL.MCAINT -t qmgr -p batch_user +connect +inq;
o setmqaut -m BATCH.SSL.MCAINT -t queue -n <queue name> -p batch_user +put +get +inq;

- Allow the user to browse the system policy queue and put messages on the error queue.
o setmqaut -m BATCH.SSL.MCAINT -t queue -n SYSTEM.PROTECTION.POLICY.QUEUE -p batch_user +browse;
o setmqaut -m BATCH.SSL.MCAINT -t queue -n SYSTEM.PROTECTION.ERROR.QUEUE -p batch_user +put;

- Defining queue policy
o setmqspl -m BATCH.SSL.MCAINT -p <queue name> -s SHA1 -a "CN=batch_user_two_way_SSL_V1,O=DIT,C=USA"

- No environment variables set for MQ server
o Assumption - Expect MQ to find MQ AMS MCA interception keystore in default location of /var/mqm/.mqs

Thanks for your help.