MQSeries.net :: View topic - MQ SSL

mqmman · Posted: Thu Oct 07, 2010 8:04 am Post subject: MQ SSL - Openssl connect

Hi,

Here is the scenario
MQ 6.0.2.0
Solaris 10

Qmgr has SSL inhouse CA certs and all the default signer certs that get installed when qmgr key db is created.

Test 1:
I issued the following command on the qmgr's host:port and it handshaked and got connected.

openssl s_client -connect host:port

Please note that I did not supply any certs to openssl command.

Test 2:
I deleted the default signer certs from the qmgr key db but left the CA certs in place and issued the same command.. It again handshaked and got connected.

Test 3:
I deleted the CA certs from the qmgr key db but left the default signer certs in place and issued the same command. This time handshake failed and did NOT get connected.

1. How is openssl able to connect to qmgr port in Test 1 and Test 2.

2. Is there a way to make MQ NOT to respond to or handshake with applications that dont supply the public key.(CA cert)

3. Not related to above: We can use one of the several ciphers on the channel.
Do strong ciphers when compared to weak ciphers have a performance impact on the message flow rate?
Is there a way to restrict Qmgr to respond to strong ciphers only?

Thank you,
mqmman