How to connect from client to IBM WebSphere Queue Manager using SSL Connection

Question

I have followed all the steps very closely to create key store, client certificate, server
certificate using with the help of below videos :

**"Configuring WMQ Explorer for TLS (Part1, Part2, Part3, Part4) as below".**
Part 1: WMQ Explorer TLS 1 of 4: Create the QMgr's KDB and certificate**
Part 2: WMQ Explorer TLS 2 of 4: Create the user's JKS and certificate
Part 3: WMQ Explorer TLS 3 of 4: Configure WMQ Explorer preferences
Part 4: WMQ Explorer TLS 4 of 4: Connecting

Now, I am trying to connect from IBM Websphere MQ Client (V7.5.0.3) to the IBM WebSphere MQ
Server (V7.5.0.2)server queue manager using SSL.

From the IBM WebSphere MQ Explorer (Client Side) : 

a) Provided the Queue Manager Name : jmsdemo
b) Selected the radio-button "Connect directly"
c) Hostname or IP Address :  Server IP
d) Port number : Server Port of the Queue Manager that i am trying to connect.
e) Server-connection channel : Server Connection Channel 
  (This server connection channel has below parameters
  MCA --> MUSR_MQADMIN
  SSL --> SSL Cipher Spec : "TLS_RSA_WITH_AES_128_CBC_SHA256"
  SSL Authentication : Required

f) After finishing all the steps, when i press the "Finish" Button. I am getting the below    
errors.

Please let me know if i missing/doing something wrong in-order to connect to SSL?

References :

a) Below error in the UI (IBM WebSphere MQ Explorer client side) :

Queue manager jmsdemo is not available for client connection due to an SSL configuration error.
(AMQ4199) Queue manager jmsdemo is not available for client connection due to an SSL
configuration error. (AMQ4199) Severity: 30 (Severe Error) Explanation: The user is trying to connect to a remote queue manager using a secure connection. Response: Check the SSL configuration of the target queue manager and the local SSL trust store.

b) Below error information is extracted "AMQERR01" error file (from Server Side)

https://docs.google.com/document/d/19b-N4qc0zXw4HiwZv5pmmeixqeClDDHgWpylalkHhqY/edit#

Thanks JK

Shashi Shashi · Accepted Answer · 2014-11-21T15:34:50

This error AMQ9660: SSL key repository: password stash file absent or unusable is likely to be caused by corrupt stash file. A stash file contains the password for the key repository. I suggest you try the following steps:

1) Go to folder where the queue manager's key repository (the .kdb file) is located.

2) Locate the stash (.sth) file of the key repository and delete it.

3) Then open the .kdb file in "IBM Key Management Tool" with the current password.

4) Once kdb file is opened, click on "Key Database File -> Stash Password" menu. This will create the stash file again.

5) (May be required): Then do a REFRESH SECURITY TYPE(SSL) for the queue manager in runmqsc.

Then attempt to connect.

How to connect from client to IBM WebSphere Queue Manager using SSL Connection

1 Answers