| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| SSL issue on Message Broker during failover |
« View previous topic :: View next topic » |
| Author |
Message
|
| Inisah |
 Posted: Wed Nov 11, 2015 8:33 pm Post subject: SSL issue on Message Broker during failover |
 |
|
Apprentice
Joined: 21 Mar 2014
Posts: 44
|
We are working on testing the failover for message broker v7006. We see a strange issue .The SSL setup on the primary works fine. But when we failover to the secondary, the applications are getting SSL handshake error.When we revert back ,its working fine again.
We confirmed that the folder which contains the SSL certs are copied properly to the secondary. This is the first time we are testing failover. Can someone let us know if we are missing something.
 |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Wed Nov 11, 2015 8:46 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
So you say the SSL certs are copied correctly over to the other instance.
Are they accessible to the broker user? Is the broker service id a local user?
Does the broker have a single / network device ip to address it? Does the broker certificate support that network ip?
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| Inisah |
| Posted: Wed Nov 11, 2015 9:30 pm Post subject: |
|
|
Apprentice
Joined: 21 Mar 2014
Posts: 44
|
| Quote: |
Are they accessible to the broker user? Is the broker service id a local user?
Does the broker have a single / network device ip to address it? Does the broker certificate support that network ip? |
The answer is yes to all the above questions. One thing that we noticed just now is , when the application is trying to access the message broker, it is failing with the below error:
CWPKI0312E: The certificate with subject DN CN=servername, OU=Zone1, O=org, L=location, ST=location2, C=XY has an end date which is no longer valid.
The end date that the above error shows is the end date of the previous certificate which is saved as BROKER1.jks_backupdate. We have the new certificate BROKER1.jks also in the same folder. Wondering why the application is trying to access the old certificate and we see this issue only in the secondary server
 |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Nov 12, 2015 12:50 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
check with mqsireport that the keystore and truststore are the ones expected. Then bounce the broker, twice. If you still see the wrong cert being access (i.e. wrong store) open a PMR.
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
