| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Problems getting SSL to work on Solaris using gsk6cmd |
« View previous topic :: View next topic » |
| Author |
Message
|
| biddljam |
 Posted: Mon Jun 07, 2004 2:51 am Post subject: Problems getting SSL to work on Solaris using gsk6cmd |
 |
|
Newbie
Joined: 07 Jun 2004
Posts: 1
|
Guys,
I'm having terrible problems getting the SSL key database setup. And before anyone asks, yes I have done a search and read through all the docs I can find here and elsewhere. I have to use the gsk6cmd commands as the machine is located in a DMZ, and it's the correct sequence of these commands that I need to establish.
The scenario is as follows:
QMA on Solaris sending to QMB on Solaris at another company and vice-versa. The key database was been created and then I requested a personal key as follows:-
gsk6cmd -certreq -create -db /var/mqm/qmgrs/QMA/ssl/key.kdb -pw password -label ibmwebspheremqqma -dn "cn........" -key_size 1024 -file filename
This was then sent to Verisign who sent the signed certificate called cert.cer.
According to the docs from what I understand I should be able to run the command
gsk6cmd -cert -receive -file cert.cer -db /var/mqm/qmgrs/TELCLEAR/ssl/key.kdb -pw password -label ibmwebspheremqqma -format ascii
However, this fails as it does not like the -label option (not valid it appears). I then took out the -label option and it failed with
No request key was found for the certificate.
When I list the keys in the database I know there should be one called ibmwebspheremqqma. I am aware I should have executed a command to create this, but i'm unsure what command to issue.
Can anyone give me the correct sequence of gsk6cmd commands I need to issue to correctly setup the key database (using Verisgn signed certificates) for queue mnanager to queue manager connection. Also, do I need to ftp my signed certificate to the other queue manager to be read into their key database?
Any help would be very much appreciated.
Cheers, James. |
|
| Back to top |
|
 |
| jed |
| Posted: Mon Jun 07, 2004 11:41 pm Post subject: |
|
|
Centurion
Joined: 08 Jan 2004
Posts: 118
Location: MI, USA
|
Since you were able to create a request for a personal certificate, you should be able to add the personal certificate coming from VeriSign.
Just a simple question... Are you uploading the correct certificate file to the correct key database where you requested the personal certificate?
When you create a certificate request and request a signed certificate from a Certificate Authority, the signed certificate is assocated with the request in the key database file it was created with. When you attempt to receive the signed certificate from the Certificate Authority, it must be placed back into the same key database as the original request. If you attempt to receive a signed certificate into a different key database, IKeyMan will not be able to associate the certificate with the request, and you will get the error message: "No request key was found for the certificate".
In other words, If you're trying to upload the CA cert and you get "No request key was found for the certificate", it means there is no request for this CA cert file that you're trying to load.
If you have the WebSphere MQ Security version 5.3 PDF file, use that for your sequence of steps and for the correct gsk6cmd command parameters.
_________________
Jed |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
