MQSeries.net :: View topic

jgooch · Posted: Fri Jan 14, 2005 7:25 am Post subject:

Hi,

We need to secure the channels between one of our queue managers and a third party's queue manager. For various reasons, we're using externally provided certs (from Thawte).

Back in September, I managed to get a Windows-based MQ-channel secured using a test cert from Globalsign. Now when I follow my notes in order to use the Thawte test cert, I don't seem to be able to import the private key part into my queue manager.

Can you help?

I'm using IKeyman to generate the CSR, running graphically on UNIX.

The steps I used were:-

1. Run Ikeyman;
2. Generate and export a CSR;
3. Get test cert from Thawte's website, they also provide a test CA. These are what I'd call *.arm format;
4. Using Windows Control Panel - Internet Options - Content - Certificates, import the test cert;
5. Export it as DER X.509;
6. FTP to the UNIX server;
7. Run IKeyman;
8. Receive the personal certificate (need to import test CA as well);
9. Export as PKCS12;
10. FTP to Windows machine;
11. Double click the PKCS12 file and import to Windows - marking it as "exportable";
12. Export as PKCS12 (de-selecting all options);
13. In MQServices, import the file and attempt to assign to the QM.

However, the import to MQ brings in only the CA, not the key. Ikeyman has a "*" by the cert, telling me that it has the key. The Windows repositories don't seem to have this.

Overall, there's got to be an easier way (!!). The above, however, with all its imports, exports and conversions, was the method I previously found to get the key into shape for use by MQ. I'm sure it will cause intakes of breath for those of you who have this nut cracked

Self-signed certs seem so much easier....

J.