C＃-带Websphere MQ版本7.0.1的SSL

Question

When connecting to an SSL enabled queue manager using C#, what values do I need to set to get the queues to work?

I currently get this error: Reason Code: 2393 MQRC_SSL_INITIALIZATION_ERROR

In my code I am setting the MQEnvironment.SSLKeyRepository and MQEnvironment.SSLCipherSpec

Is there something else I need to set with C# to make this work? I have seen some Java examples that set keystore passwords and types and things.

I have also seen examples setting system environment variables too, but that hasn't seemed to make any difference either.

Answer 1

The general pattern for debugging WMQ SSL is as follows...

1. Get the application to connect using no SSL. This eliminates problems with connectivity, wrong queue or queue manager names, etc.
2. Get SSL working with server-only authentication. This means setting SSLCAUTH(OPTIONAL) on the SVRCONN channel. The QMgr will present a certificate that the application must trust but the application does not need to authenticate back to the server. This validates that both the application and the QMgr can access their keystores and that the QMgr's certificate or CA chain are properly loaded in the app's keystore.
3. Finally, set SSLCAUTH(REQUIRED) in the SVRCONN channel so that the application authenticates back to the QMgr. At this point the only possible problems are that the QMgr doesn't trust the app's cert or CA.

If the connection attempt is refused by the QMgr, the errors at the client will purposely be cryptic. The detailed messages will be found in the QMgr's AMQERR??.LOG files. If the failure is at the client, these messages will be found in the client's error logs or you can enable trace.

Enable trace using the strmqtrc command and stop it with endmqtrc . The WMQ Clients manual has a section describing where client trace files end up and another section dedicated to tracing on Windows in general. This can be very useful in determining client-side configuration problems such as failing to find a private key, failing to find a keystore, etc.

In your case, the 2393 indicates that something in the client configuration is failing. Since you are no longer getting the error with the keystore password, I'm guessing it may be having problems finding a private key or not trusting the cert provided by the QMgr. In the first case, setting SSLCAUTH(OPTIONAL) will work because the client' won't need it's private key. However if the problem is trusting the QMgr or other configuration issues, SSLCAUTH(OPTIONAL) won't help but tracing should sort that out.

Incidentally, the need to trace and diagnose on the client side is why IBM does not support client installations where the jars or libs were copied over rather than running the full client install. Although you can get the client to run by copying a few lib files and classes, this does not provide all the facilities for tracing and diagnostics. If you have not performed a full client install, some of what I've described here will not be possible. If that is the case, download and install the client from SupportPac MQC7 .