| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| SSL and MQ |
« View previous topic :: View next topic » |
| Author |
Message
|
| Clamjammer |
 Posted: Mon Jun 22, 2015 12:20 pm Post subject: SSL and MQ |
 |
|
Newbie
Joined: 08 Mar 2012
Posts: 5
|
| Using version 7.0 .11, im trying to add ssl certificates to my mq explorer clients. I wanted to use CA signed certificates, but because queue managers can only hold 1 personal certificate - this forces me to use CA certs for my queue manager to queue manager connections as well (wanted 2 way between servers). Other than using a third party authentication tool, can i have CA certs for clients, and 2 way for server connections? I thought about using ipt, but not sure how i would configure the routes. |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Mon Jun 22, 2015 1:38 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20697
Location: LI,NY
|
You can use MQIPT to switch the cert on a qmgr. Typically MQIPT will reside in the DMZ.
You can also have qmgr to qmgr connection with an internal CA and a public CA signed cert. Yes the qmgr can only use 1 cert but it may be either self signed or a CA signed (Private = internal or Public = external)
If you want to use 2 way for clients (including MQE) you will need to have a client cert store and a client cert. The client cert should be labelled: ibmwebspheremq<userid> where you replace <userid> with the actual userid.
Example: label=ibmwebspheremqbanderson DN="CN=banderson,...."
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| Clamjammer |
| Posted: Tue Jun 23, 2015 3:40 am Post subject: |
|
|
Newbie
Joined: 08 Mar 2012
Posts: 5
|
| Thanks for the info, I will play around with and ipt instance for admin connections. Hopefully i'll be able to work something out. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Tue Jun 23, 2015 5:59 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
You can control whether a given channel uses two way or one way.
This allows you to use the same set of certs issued by a CA, and have the clients merely trust the CA and the servers trust the personal certificates.
But if you upgrade to v8 - which you should for maintenance reasons - I believe you can then use different certs for different channels. This might also be possible in 7.1 or 7.5... I don't remember. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Tue Jun 23, 2015 6:28 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20697
Location: LI,NY
|
| mqjeff wrote: |
You can control whether a given channel uses two way or one way.
This allows you to use the same set of certs issued by a CA, and have the clients merely trust the CA and the servers trust the personal certificates.
But if you upgrade to v8 - which you should for maintenance reasons - I believe you can then use different certs for different channels. This might also be possible in 7.1 or 7.5... I don't remember. |
No using a different cert for a channel it's a feature of V8 only...
V7.5 allows you to choose between any and RFC5280 for cert validation policy...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
