MQSeries.net :: View topic - Using OpenLDAP to check Certificate Revocation List (CRL)

blee

Has anyone successfully use OpenLDAP to check Certificate Revocation List (CRL)?

Our situations:

1. Created and installed all the signed certs for the qmgrs using OpenSSL.
2. Created sender and receiver channels for the qmgrs. (with corresponding CipherSpec).
3. Successfully connected the channels.
4. Configured the qmgrs to use CRL (following instructions in MQ Security manual)
5. The same channels failed to start.

The MQ error log:

4/20/2006 09:57:34 - Process(2876.1) User(leebr) Program(runmqchl.exe)
AMQ9646: Channel 'SSLLOCAL.SSLLOCAL2' could not connect to any LDAP CRL
servers.

-----------------------------------------------------------
EXPLANATION:
LDAP Certification Revocation List (CRL) servers were specified but a
connection could not be established to any of them. The channel is
'SSLLOCAL.SSLLOCAL2'; in some cases its name cannot be determined and so is shown as '????'. The channel did not start.
-----------------------------------------------------------

I used several LDAP clients (eg. LDAP Browser) and was able to connect and search the OpenLDAP directory. That means the LDAP is running. For testing purposes, the LDAP is configured to allowed anonymous access.

Any suggestions would be greatly appreciated.