MQSeries.net :: View topic - Problem with SSL

fernando2867 · Posted: Tue May 07, 2019 4:50 pm Post subject:

Hi! My name is Fernando, and it is my second topic in the forum. I work with MQ for many years, but I donâ€™t know SSL. So Iâ€™ve used the script below to implement SSL from a C# (MQ client V8 ) to a MQ Server V8, and it worked fine.
But Iâ€™ve tried the same script with MQ V9 (both client and server), and it is returning reason code 2059. Would you help me with this problem? I have a trace of this situation.

Thanks in advance and sorry about my poor Englishâ€¦..Fernando

Certificate creation:

Client machine:

runmqakm -keydb -create -db "client.kdb" -pw Citi2019 -type cms -expire 1825 -stash
runmqakm -cert -create -db "client.kdb" -pw Citi2019 -label ibmwebspheremqds26073 -dn "cn=ibmwebspheremqds26073, o=dev, c=br" -sigalg SHA256 -size 2048
runmqakm -cert -extract -db "client.kdb" -pw Citi2019 -label ibmwebspheremqds26073 -target ibmwebspheremqds26073.crt -format ascii

Server machine:

Folder: /var/mqm/qmgrs/BJ_QM_SIT/ssl/

runmqakm -keydb -create -db "key.kdb" -pw Citi2019 -type cms -expire 1825 -stash
runmqakm -cert -create -db "key.kdb" -pw Citi2019 -label ibmwebspheremqbj_qm_sit -dn "cn=ibmwebspheremqbj_qm_sit, o=dev, c=br" -sigalg SHA256 -size 2048
runmqakm -cert -extract -db "key.kdb" -pw Citi2019 -label ibmwebspheremqbj_qm_sit -target ibmwebspheremqbj_qm_sit.crt -format ascii

Importing server certificate to client machine:

runmqakm -cert -add -db "client.kdb" -pw Citi2019 -label ibmwebspheremqbj_qm_sit -file ibmwebspheremqbj_qm_sit.crt -format ascii

Importing client certificate to server:

runmqakm -cert -add -db "key.kdb" -pw Citi2019 -label ibmwebspheremqds26073 -file ibmwebspheremqds26073.crt -format ascii

Queue definition:

DEFINE QLOCAL (BJBLOCK.BR.LIL.RESPONSE)
SET AUTHREC PROFILE(BJBLOCK.BR.LIL.RESPONSE) OBJTYPE(QUEUE) PRINCIPAL('ds26073') AUTHADD(PUT,GET)
SET AUTHREC OBJTYPE(QMGR) PRINCIPAL('ds26073') AUTHADD(CONNECT)

Server connection channel definition:

DEFINE CHANNEL('FLAECOMM_QM.BJ_QM') CHLTYPE(SVRCONN) MCAUSER('ds26073') TRPTYPE(TCP)
SET CHLAUTH(FLAECOMM_QM.BJ_QM) TYPE(ADDRESSMAP) ADDRESS(*) MCAUSER('ds26073')
SET AUTHREC PROFILE('FLAECOMM_QM.BJ_QM') GROUP('mqm') OBJTYPE(CHANNEL) AUTHADD(CHG,DLT,DSP,CTRL,CTRLX)

Alter channel to use AES256 certificate:

ALTER CHANNEL('FLAECOMM_QM.BJ_QM') CHLTYPE(SVRCONN) SSLCIPH('TLS_RSA_WITH_AES_256_CBC_SHA256')

Authorize user:

setmqaut -m BJ_QM_SIT -t qmgr -p ds26073 +connect +inq

After the steps above, Iâ€™ve used the example below to access MQ server using C# (it works with â€œamqdnet.dllâ€ in MQ version 8.0.0.6, but in version 9.0.0 and higher, it returns reason code 2059)

var properties = new Hashtable
{
{ MQC.TRANSPORT_PROPERTY, â€œTCPâ€ },
{ MQC.HOST_NAME_PROPERTY, â€œlocalhostâ€ },
{ MQC.PORT_PROPERTY, 1414 },
{ MQC.CHANNEL_PROPERTY, â€œFLAECOMM_QM.BJ_QMâ€ }
};

properties.Add(MQC.SSL_CERT_STORE_PROPERTY, â€œC:\lixo\MQCitibank\Certificado\clientâ€);
properties.Add(MQC.SSL_CIPHER_SUITE_PROPERTY, â€œSSL_RSA_WITH_AES_256_CBC_SHA256â€);
properties.Add(MQC.SSL_CIPHER_SPEC_PROPERTY, â€œTLS_RSA_WITH_AES_256_CBC_SHA256â€);
properties.Add(MQC.SSL_PEER_NAME_PROPERTY, â€œâ€);

try
{
var MQQueueManager = new MQQueueManager(queueManagerDTO.QueueManager, properties);
}
catch (Exception E)
{
MessageDialog.Show(E.Message);
}