IBM MQ - SSL Config for Multiple Queue Managers

Question

In my IBM MQ, I have multiple queue managers which I need to enable SSL.

I've been following this blog and successfully configured SSL to a single queue manager.

If I have more than 1 queue manager, do I need to have a dedicated keystore for each queue manager?

Is there a way to have a global/common keystore and enable SSL for all the queue managers using that keystore?

Have this question since the blog says,

"A word about the certificate label here. Default name for this certificate is in the form of: 'ibmwebspheremq' + 'queue manager name' (all lower case) In our case this becomes: 'ibmwebpsheremqmyqm01'"

Any guidance would be very much helpful.

IBM MQ v 9.1

Answer 1

The answer like many of these questions is it depends. If you can send the keystore files around to each machine - securely then you could have the same files for all of your queue manages. If you do it insecurely then people could take a copy of your keystores and impersonate you, and see all your traffic.

If you have your private certificate in an external HSM (think Secure USB store), you cannot get the private key to another machine, and so you will have to get a machine unique certificate.

You can use CERTLABL(...) to specify the name of the certificates in the keystore.

Ive just (today) put up some blog posts about TLS on midrange. See https://colinpaice.blog/2021/02/13/which-cipher-spec-and-certificate-type-should-i-use-for-the-mq-server-tls-1-2

Answer 2

When Queue Managers are on the same machine, then you can use the same keystore for all your Queue Managers. You can just specify the same file in the SSL config of the Queue Managers. For example:-

ALTER QMGR SSLKEYR('/central/ssl/key')

The different Queue Managers will find their personal certificate based on the label of the cert. That's what that quote is about. For example:-

On Queue Manager MQG1

DISPLAY QMGR CERTLABL

QMNAME(MQG1)       CERTLABL(ibmwebspheremqmqg1)

On Queue Manager MQG2

DISPLAY QMGR CERTLABL

QMNAME(MQG2)       CERTLABL(ibmwebspheremqmqg2)

These are the names that the queue manager will look for in the keystore by default. As you can see they are different for each queue manager and so can happily co-exist in the same keystore. If you want to choose different labels for the certificates, just alter the CERTLABL attribute of each Queue Manager.