| Author |
Message
|
| adrao45 |
 Posted: Thu Mar 28, 2013 5:40 pm Post subject: SSL client setup issue in message broker v8 |
 |
|
Novice
Joined: 29 Nov 2004
Posts: 12
|
Hi Experts,
I am using WMB V8.1 and have requirement to invoke the webservice SOAP over HTTPS.The webservice provider provided .p12 keystore file.
I had done the following the following steps .
----------------------------------------------------------------------------------------------------------------------------------
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\dls.p12
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststoreType -v PKCS12
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststorePass -v password
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\dls.p12
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystoreType -v PKCS12
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystorePass -v password
--------------------------------------------------------------------------------------------------------------------------------------------
I got the following error "java.security.KeyStoreException: IBMKeyManager: Problem accessing key store java.io.IOException: Unable to verify MAC."
The infocenter says "The only supported type of store is Java keystore (JKS)"
After that I have converted from PKCS12 store to java keystore(jks) using keytool.I have verified key entry's in java keystore(jks) and those entry's looks good.
Executed the following commands.
------------------------------------------------------------------------------------------------------------------------------
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\dls.jks
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\dls.jks
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststoreType -v JKS
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystoreType -v JKS
mqsisetdbparms Broker -n EG::keystorePass -u na -p "password"(tried with/without quotes)
mqsisetdbparms Broker -n EG::truststorePass -u na -p "password"(tried with/without quotes)
---------------------------------------------------------------------------------------------------------------------------------
This got the following error "java.security.KeyStoreException: IBMKeyManager: Problem accessing key store java.io.IOException: Keystore was tampered with, or password was incorrect"
Can you guys let me know what is the right way to do SSL client setup in messagebroker?
Thanks,
ADR |
|
| Back to top |
|
 |
| adrao45 |
| Posted: Thu Mar 28, 2013 7:57 pm Post subject: |
|
|
Novice
Joined: 29 Nov 2004
Posts: 12
|
I have successfully invoked the provider webservice after I have imported the client certificate(which I had received from provider) into the "cacerts" keystore of Broker .And after executed the following commands
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\cacerts,JKS
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\cacerts,JKS
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n truststoreType -v JKS
mqsichangeproperties Broker -e EG -o ComIbmJVMManager -n keystoreType -v JKS
mqsisetdbparms Broker -n EG::keystorePass -u temp -p password
mqsisetdbparms Broker -n EG::truststorePass -u temp -p password
mqsichangeproperties Broker -o BrokerRegistry -n brokerKeystoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\cacerts
mqsichangeproperties Broker -o BrokerRegistry -n brokerTruststoreFile -v C:\IBM\MQSI\8.0.0.1\jre16\lib\security\cacerts
mqsisetdbparms Broker -n brokerKeystore::password -u temp -p password
mqsisetdbparms Broker -n brokerTruststore::password -u temp -p password
I am using oneway ssl .Now I need to implement this setup in AIX environment and AIX broker has already been pointing to some other keystore .
How to do SSL client setup without impacting exisitng SSL steup on AIX broker.
Any help would be appreciated
Thanks,
ADR. |
|
| Back to top |
|
|
| lancelotlinc |
| Posted: Fri Mar 29, 2013 4:26 am Post subject: Re: SSL client setup issue in message broker v8 |
|
|
Jedi Knight
Joined: 22 Mar 2010
Posts: 4941
Location: Bloomington, IL USA
|
| adrao45 wrote: |
| I am using WMB V8.1 |
WOW !! Where did you get it? I can only get 8.0.0.1. I would really like to use 8.1. How can I download it?
_________________
http://leanpub.com/IIB_Tips_and_Tricks
Save $20: Coupon Code: MQSERIES_READER |
|
| Back to top |
|
|
| smdavies99 |
| Posted: Fri Mar 29, 2013 7:21 am Post subject: Re: SSL client setup issue in message broker v8 |
|
|
Jedi Council
Joined: 10 Feb 2003
Posts: 6076
Location: Somewhere over the Rainbow this side of Never-never land.
|
| lancelotlinc wrote: |
| adrao45 wrote: |
| I am using WMB V8.1 |
WOW !! Where did you get it? I can only get 8.0.0.1. I would really like to use 8.1. How can I download it? |
8.0.0.2 is out you know!  
_________________
WMQ User since 1999
MQSI/WBI/WMB/'Thingy' User since 2002
Linux user since 1995
Every time you reinvent the wheel the more square it gets (anon). If in doubt think and investigate before you ask silly questions. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Fri Mar 29, 2013 10:34 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
The answer to the question as asked is that you don't have to do anything with existing keystores and truststores other than import certificates into them.
The only steps that need to be done are the ones that import certs, not any of the steps to create a new keystore/truststore or register that with the Broker.
This should be fairly obvious. |
|
| Back to top |
|
|
|
|
