CODEWITHSUNDEEP
sslibm-mq
Program.X
Program.X

Reputation: 7412

IBM MQ: Establishing an SSL connection

We're struggling to get IBM MQ to work across SSL.

We've been provided with the certificate chain for the remote host and installed into the Windows Certificate Store (Local Machine). These all look valid.

We're using the following connection properties:

        connectionProperties.Add(MQC.SSL_PEER_NAME_PROPERTY, "other-server.com");            
        connectionProperties.Add(MQC.SSL_CIPHER_SUITE_PROPERTY, "TLS_RSA_WITH_AES_256_CBC_SHA256");            connectionProperties.Add(MQC.SSL_CIPHER_SPEC_PROPERTY, "TLS_RSA_WITH_AES_256_CBC_SHA256"); 
        connectionProperties.Add(MQC.SSL_CERT_STORE_PROPERTY, "*SYSTEM"); 
        connectionProperties.Add("CertificateLabel", "ibmwebspheremqmywindowsusernamewithoutdomain"); 
        MQEnvironment.SSLCertRevocationCheck = true;

We've established that the "CertificateLabel" is the "Friendly name" in Windows parlance.

We've proven unencrypted communication and network-level configuration.

We're using 8.0.0.7 client.

These are the issues we've come across:

General questions:

Upvotes: 2

Views: 1562

Answers (1)

Program.X
Program.X

Reputation: 7412

The issue was the following line:

connectionProperties.Add(MQC.SSL_PEER_NAME_PROPERTY, "otherserver.com");

Turns out that:

  1. It needs it in a canonical format, so DN=, etc.
  2. You don't even need that line

Though we did learn a few things along the way:

  • The line:

    connectionProperties.Add("CertificateLabel", "ibmwebspheremqmyusername");

    Is the string ibmwebspheremq plus your Windows username (without your domain) and the label should be set on the Friendly name of your client machine's outgoing certificate NOT including the username.

  • The various folders inside your Windows certificate store are significant. The intermediate CAs should be correctly filed.

Upvotes: 2

Related Questions