| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Certificates and securing MQ |
« View previous topic :: View next topic » |
| Author |
Message
|
| andres |
 Posted: Sat Mar 18, 2023 7:41 am Post subject: Certificates and securing MQ |
 |
|
Apprentice
Joined: 12 Apr 2013
Posts: 27
|
Hi,
IM planning the deploy of MQ on OPenshift, and after "fighting" with certificates, etc, im good to go.
My questions is how to planify certificates for MQ MAnager, Clients and web console.
We have a private CA, and im thinking if is a good idea to use wildcard certs.
CN=qmanangername.mq.mydomain.org
or one for all qms
CN=*.mq.mydomain.org
For MQ Manager, lets say i create a cert with our ca. should the files crt and key be in the same certificate label?
For client authentication, i dont want to use MQ port, so i want to connect all via https. is it enought to use LDAP user auth plus MQ manager cert in the clients? (clients can be MQ Explorer, ERP, etc).
I believe i dont need mutual TLS if im using ldap auth, so i guess is it fine with a single CA cert?
For web console, is it fine to use MQ Manager cert or should i deploy another cert? looks like i can use LDAP too and point to an specific label in the config.
thanks
I b |
|
| Back to top |
|
 |
| hughson |
| Posted: Mon Mar 20, 2023 10:11 am Post subject: Re: Certificates and securing MQ |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
| andres wrote: |
| For client authentication, i dont want to use MQ port, so i want to connect all via https. is it enought to use LDAP user auth plus MQ manager cert in the clients? (clients can be MQ Explorer, ERP, etc). |
Why don't you want to use the MQ listener? How do you plan to get MQ clients such as MQ Explorer to connect if you don't?
Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| andres |
| Posted: Mon Mar 20, 2023 2:48 pm Post subject: |
|
|
Apprentice
Joined: 12 Apr 2013
Posts: 27
|
HI,
I probably forgot to mention than in a OpenShift deployments, we create HTTPS routes that "route" the traffic to whatever listener port.
The other way is to open the listener ports. In a HA environment required to open the ports in each OpenShift node (a node could be hosting something else than MQ), but we dont want that.
Still not sure if i will have clients that can not use HTTPS/SSL, but this will be the prefered method. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
