| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Client certificate naming conventions? |
« View previous topic :: View next topic » |
| Author |
Message
|
| bruce2359 |
 Posted: Tue Jan 18, 2011 12:49 pm Post subject: Client certificate naming conventions? |
 |
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
I'm adding SSL to client and svrconn channels. I'm testing. I'm learning. I'm trying to develop a naming standard.
1) I've created a new client keystore.
2) I've created a new self-signed client certificate labeled ibmwebspheremqadministrator (for testing purposes only).
3) I've exported the client certificate
4) I've imported the qmgr cert as a signer-cert.
5) I've imported the new client cert to the qmgr keystore as a signer. I'm pondering this.
It seems that when importing a client signer-certificate into the server keystore, the client cert doesn't need to follow the ibmwebspheremq naming convention. Have I misundersood this?
Regarding 2) above: What naming conventions do you use (can you recommend) for the label (other than ...administrator)? An app-specific groupname?
Regarding 5) above: Naming a client cert ibmsebspheremqclient is too general. What naming conventions are you using (can you recommend) for client certs?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
 |
| mqjeff |
| Posted: Tue Jan 18, 2011 1:06 pm Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
The label of a certificate in keystore 1 is not relevant to whether or not it is used or verified or findable in keystore 2.
in the typical case, you will use CA signed certificates. This means that the server keystore only needs to have the CA signer cert and it's own personal cert in it. It then trusts any certificate that has been signed by the CA as being allowed to connect.
You then use SSL Peer, which matches against the Distinguished Name of the client certificate (which is issued and verified by the CA). This ensures that if Bob Nelson is using a client certificate that he has stashed in his client certificate as ibmwebspheremqwasuser, that he can only connect to those specific channels that have an SSL Peer that matches Bob Nelson's DN.
You then use MCAUSER on the channel to scope everyone who has a cert that matches the DN value set on SSLPEER into a specific role. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Tue Jan 18, 2011 4:47 pm Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| in the typical case, you will use CA signed certificates. |
Yes. This is for an intranet-based app.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Tue Jan 18, 2011 6:16 pm Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
| bruce2359 wrote: |
| Quote: |
| in the typical case, you will use CA signed certificates. |
Yes. This is for an intranet-based app. |
I did not say it had to be a public CA.
Regardless. You can assume everything else as I said, and replace "signer cert" with "client cert".
The label you use in keystore 1 has nothing to do with the label you use in keystore 2. In fact, label is a relatively non-standard IBM extension that allows things like MQ to have a more meaningful and understandable way to identify which of many particular certificates in the keystore are "the right one" to use.
ETA: "the right one" to use as the identify of the "self", and not anything that is passed over the wire. The label is only used to identify which key in the local keystore should be assigned to the local entity - either the server or the client. The label is not, AFAIK, passed over the wire. Only the cert itself is.
And again, the label is not part of the cert. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
