ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » cert details of a partner

Post new topic  Reply to topic
 cert details of a partner « View previous topic :: View next topic » 
Author Message
MQMB&WAS
PostPosted: Tue Aug 11, 2020 6:59 pm    Post subject: cert details of a partner Reply with quote

Centurion

Joined: 12 Jun 2016
Posts: 130

Hello experts,

I need to check the details of ssl certs like the serial number, expiry, DN.. of the certs belonging to all the remote qmgrs that my qmgr is communicating with ssl.
How do I do this wit hthe runmqakm commands? The commands I've tried so far are only displaying me the details of our own cert.

Appreciate if you could help.

Thanks
Back to top
View user's profile Send private message
hughson
PostPosted: Tue Aug 11, 2020 8:56 pm    Post subject: Reply with quote

Padawan

Joined: 09 May 2013
Posts: 1914
Location: Bay of Plenty, New Zealand

If you have set up your certificates as CA signed certificates, then I would not expect that your partner's certificates would be in your key repository. You have no need for them to be, only the CA certificate which signed them needs to be in YOUR key repository.

If you only need to check details like the serial number and DN you can see that when the channel from the partner is running by using the following command:
Code:
DISPLAY CHSTATUS(channel-name) SSLPEER


Finding out the expiry will probably require a conversation with the administrator of the partner queue manager.

Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software
Back to top
View user's profile Send private message Visit poster's website
MQMB&WAS
PostPosted: Tue Aug 11, 2020 9:12 pm    Post subject: Reply with quote

Centurion

Joined: 12 Jun 2016
Posts: 130

Thanks for your response, Morag.

Our sender channel to our partner isn't working and in the errors its throwing ssl errors with the details of the partners' certs like CN, serial number.....

My goal is to check if their certs exist in our kdb. How do I check this?

Thanks for your time.
Back to top
View user's profile Send private message
hughson
PostPosted: Tue Aug 11, 2020 9:38 pm    Post subject: Reply with quote

Padawan

Joined: 09 May 2013
Posts: 1914
Location: Bay of Plenty, New Zealand

MQMB&WAS wrote:
My goal is to check if their certs exist in our kdb. How do I check this?

Well it sounds like you have already discovered that the certs DO NOT exist in your KDB. But for the avoidance of doubt, to list ALL the certs in your KDB, try this command.

Code:
runmqakm -cert -list all -db key.kdb -stashed


Then to show the details of a particular cert, try this command.

Code:
runmqakm -cert -details -label CertLabelFromAboveCommand -db key.kdb -stashed


Are you sure the certs are SUPPOSED to be in your KDB?

MQMB&WAS wrote:
Our sender channel to our partner isn't working and in the errors its throwing ssl errors with the details of the partners' certs like CN, serial number.....

Could you show us an example of the error please?

Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software
Back to top
View user's profile Send private message Visit poster's website
MQMB&WAS
PostPosted: Thu Aug 13, 2020 10:49 am    Post subject: Reply with quote

Centurion

Joined: 12 Jun 2016
Posts: 130

Hello Morag,

The issue has was with our partner qmgr. Their certs expired and they had to renew.

My questions: When the partner renews their personal certs, don't we have to add their new root/intermediate certs to our kdb?? in this case, they didn't send us any but the channel started working after they renewed/installed at their end.

another question: so from what I understand, there's no way for us to find out the expiry details of partners' certs just by looking at our kdb file. is this correct?

q3: how to display the details of the partner's root/intermediate cert details from our kdb??

Appreciate your time.
Back to top
View user's profile Send private message
tczielke
PostPosted: Thu Aug 13, 2020 11:30 am    Post subject: Reply with quote

Guardian

Joined: 08 Jul 2010
Posts: 939
Location: Illinois, USA

This MQ Community blog posts talks about how you can get a queue manager certificate (and their signer certs would be included in the output, as well) with openssl s_client.

https://community.ibm.com/community/user/imwuc/blogs/tim-zielke1/2020/04/24/using-openssl-s-client-with-ibm-mq?CommunityKey=183ec850-4947-49c8-9a2e-8e7c7fc46c64&tab=Blogs
_________________
Working with MQ since 2010.
Back to top
View user's profile Send private message
Vitor
PostPosted: Thu Aug 13, 2020 11:38 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

MQMB&WAS wrote:
My questions: When the partner renews their personal certs, don't we have to add their new root/intermediate certs to our kdb?? in this case, they didn't send us any but the channel started working after they renewed/installed at their end.


Not if they renewed with the same provider. You would have got a certificate signed by a root and intermediate cert chain you already trusted.
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
jon.austen
PostPosted: Thu Aug 13, 2020 12:27 pm    Post subject: Reply with quote

Newbie

Joined: 03 Aug 2020
Posts: 9

This sounds like I have almost the same question in this thread: http://www.mqseries.net/phpBB2/viewtopic.php?t=77374
Back to top
View user's profile Send private message
hughson
PostPosted: Thu Aug 13, 2020 8:02 pm    Post subject: Reply with quote

Padawan

Joined: 09 May 2013
Posts: 1914
Location: Bay of Plenty, New Zealand

MQMB&WAS wrote:
My questions: When the partner renews their personal certs, don't we have to add their new root/intermediate certs to our kdb?? in this case, they didn't send us any but the channel started working after they renewed/installed at their end.

As @Vitor says, not if they renewed their certificate with the same CA. The verification would continue to work with the CA certificates you had from the previous certificate.

MQMB&WAS wrote:
another question: so from what I understand, there's no way for us to find out the expiry details of partners' certs just by looking at our kdb file. is this correct?

This is correct

MQMB&WAS wrote:
q3: how to display the details of the partner's root/intermediate cert details from our kdb??

Issue this command:-
Code:
DISPLAY CHSTATUS(chl-name) SSLCERTI

to see the Issuer DN for that connection (SSLPEER attribute for the Subject's DN), then look for that DN in your KDB.

Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software
Back to top
View user's profile Send private message Visit poster's website
fjb_saper
PostPosted: Fri Aug 14, 2020 5:00 am    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20696
Location: LI,NY

hughson wrote:

MQMB&WAS wrote:
q3: how to display the details of the partner's root/intermediate cert details from our kdb??

Issue this command:-
Code:
DISPLAY CHSTATUS(chl-name) SSLCERTI

to see the Issuer DN for that connection (SSLPEER attribute for the Subject's DN), then look for that DN in your KDB.

Cheers,
Morag


Not quite. If you're looking for your partner's DN and intermediary run
Code:
dis chs(chl-name) sslpeer sslcerti

The SSLPEER field will show the partner's DN and possibly cert id number and the SSLCERTI will show the information about the next signer cert in the chain.
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » cert details of a partner
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.