Issue with SSL connection to IBM WEB MQ

Question

I'm trying to connect with ssl "Required" channel with c#.net application. I followed below steps to create and exchange the certificates

With the help of IBM key management tool I created self-signed certificate in websphere MQ server (192.168.10.2) then extracted it as server.arm

Then did the same things for client side

After that I copied server.arm to client machine (192.168.10.1) and client.arm to WMQ server (192.168.10.2)

In server's IBM key management tool I selected signer certificates and added client.arm I set the label name as ibmwebspheremqclient then in client machine (192.168.10.1) I added server.arm as signer certificate and set label as ibmwebspheremqqm_sslconnect

Here is my channel configuration. If I set this setting as optional then this is working fine for me but I must have to enable SSL option as "Required".

when I tried to connect with this code block

using IBM.WMQ;
using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

    public class SSLConnectionTest
        {
            const String connectionType = IBM.WMQ.MQC.TRANSPORT_MQSERIES_CLIENT;
            const String qManager = "QM_SSLConnect";
            const String hostName = "192.168.10.2";
            const String channel = "ADMIN.TLS.SVRCONN";
            const String port = "1480";
            const String sslKeyRepository = @"C:\Program Files (x86)\IBM\WebSphere MQ\ssl\key";
            const String cipherSpec = "TLS_RSA_WITH_AES_128_CBC_SHA256";
            const String cipherSuite = "SSL_RSA_WITH_AES_128_CBC_SHA256";

            public Hashtable init()
            {
                Hashtable properties = new Hashtable();

                properties.Add(MQC.TRANSPORT_PROPERTY, MQC.TRANSPORT_MQSERIES_CLIENT);
                properties.Add(MQC.HOST_NAME_PROPERTY, hostName);
                properties.Add(MQC.PORT_PROPERTY, port);
                properties.Add(MQC.CHANNEL_PROPERTY, channel);

                properties.Add(MQC.SSL_CERT_STORE_PROPERTY, sslKeyRepository);
                properties.Add(MQC.SSL_CIPHER_SUITE_PROPERTY, cipherSuite);
                properties.Add(MQC.SSL_CIPHER_SPEC_PROPERTY, cipherSpec);

                return properties;
            }

            public void TestSSLConnection()
            {
                try
                {
                    Hashtable connectionProperties = init();
                    MQQueueManager qMgr = new MQQueueManager(qManager, connectionProperties);

                }
                catch (MQException ex)
                {
                    Console.WriteLine("A WebSphere MQ error occurred: {0}", ex.ToString());
                }
                catch (System.Exception ex)
                {
                    Console.WriteLine("A System error occurred: {0}", ex.ToString());
                }
            }

        }

it gives me this error code

I already refreshed REFRESH SECURITY TYPE(SSL)

I found following errors in my client (192.168.10.1) C:\Program Files (x86)\IBM\WebSphere MQ\errors\AMQERR01.LOG https://docs.google.com/document/d/1gc0AoxQpdLNg1pz_vkw-tapWDNclYXY5ql_aMIVBMfA/edit?usp=sharing

and my server's 192.168.10.2 error log https://docs.google.com/document/d/1lxzo41TWauAyYKH1wcXOxj6HYlTYkSUoPjaTmsJHxYI/edit?usp=sharing

Can anyone help me ???

Answer 1

The errors in the AMQERR01.LOG files are telling you that the client side certificate is not being picked up. The label should be ibmwebspheremq<client-logged-on-user>

From your screen shots I can see that your certificate label is ibmwebspheremqclient but from the screen shot of the command prompt it appears your logged on user ID might actually be herath, in which case the MQ code will be looking for a certificate label ibmwebspheremqherath, not finding it and so going anonymous.

Rename the label of your client side certificate to the appropriate label and see if it now picks it up.