MQSeries.net :: View topic

RimRim · Posted: Tue Jan 24, 2023 7:09 pm Post subject:

I am facing SSL error when trying to connect from QM1 to QM2. There are few other channels running from QM1 to other QMGR's and server conn as well. But particulary to 2 QMGR's when trying to connect from QM1 facing error as:

Bad SSL certificate for channel '????'.

A certificate encountered during SSL handshaking is regarded as bad for one of the following reasons: &B (a) it was formatted incorrectly and could not be validated &B (b) it was formatted correctly but failed validation against the Certification Authority (CA) root and other certificates held on the local system &B (c) it was found in a Certification Revocation List (CRL) on an LDAP server &B (d) a CRL was specified but the CRL could not be found on the LDAP server &B (e) an OCSP responder has indicated that it is revoked &B (f) The keysize of the certificate is too small for the configured limit. (MinimumRSAKeySize) &P The channel is '????'; in some cases its name cannot be determined and so is shown as '????'. The remote host is 'XXXXXX'. The channel did not start. &P The details of the certificate which could not be validated are '[Class=]GSKVALMethod::X509
[Issuer=]CN=XXXXXX,
DC=xxx,DC=xxxxxxx,DC=net[#=]7700000733bgh8ewdedaasdadc604768720002733
[Subject=]CN=ibmwebspheremqqm1,OU=MQ,O=XXXXX,L=XXX,C=XX
[Class=]GSKVALMethod::X509[Issuer=]CN=XXXXXXX'. &P
The certificate validation error was 575032.

Check which of the possible causes applies on your system. Correct the error, and restart the channel. &P This error might indicate that the remote end of the channel is configured to send the wrong certificate. Check the certificate label configuration at the remote end of the channel and ensure that the local key repository contains all of the necessary CA certificates.

The certificate validation error was 575032 - The certificate is revoked.

Not sure how come 575032, as from the same qmgr, channels to other qmgr's are running whereas to specific QM2 not working. Kindly provide your inputs.[/i]