MQSeries.net :: View topic - Connection between QMs having SHA1 and SHA2 certs failed

kordi · Posted: Fri Oct 16, 2015 4:10 am Post subject:

Hello,

I have a task to change all existing certificates from SHA1 to SHA2 and after that SSL to TLS. What I found out is that when QM1 has SHA1 (Signature Algorithm: MD5withRSA, Key Size:1024) and QM2 has SHA2 (Signature Algorithm: SHA256withRSA, Key Size: 2048) SSL channels are not able to connect (below are logs from QM1 and QM2). That would do my work more difficult because I cannot just go one QM after another and change certs but I have to do that on all connected with each other Queue Managers.

Any advice would be much appreciated.

QM1 logs:
AMQ9637: Channel is lacking a certificate.

EXPLANATION:
The channel is lacking a certificate to use for the SSL handshake. The channel
name is 'QM1.QM2' (if '????' it is unknown at this stage in the SSL
processing).

The remote host is 'xyz (10.10.10.10)'.

The channel did not start.
ACTION:
Make sure the appropriate certificates are correctly configured in the key
repositories for both ends of the channel.

======================
QM2 logs
AMQ9654: Validation checks for the remote personal certificate failed. The
channel did not start.

EXPLANATION:
An SSL certificate received from the remote system was not corrupt but failed
validation checks on something other than its ASN.1 fields and date. It is
possible that the certificate chain could not be built for for one of the
following reasons: - The certificate Subject DN is more than 1024 characters
long. - The DN contains unsupported duplicate attribute values. - The DN is
missing.

The channel is 'QM1.QM2'; in some cases its name cannot be determined and
so is shown as '????'.
ACTION:
Ensure that the remote system has a valid personal certificate and restart the
channel. Restart the channel.