We recently had an issue where an SSL certificate was updated for the MQTT channel. I did the 'REFRESH SECURITY TYPE(SSL)' then stopped and started the MQTTS channel. We had some servers where the new cert was in the TrustStore but the old one was still being used. Seems like a race condition between the refresh and the stop/start.

What method can I use to hit the MQTTS channel and display the certificate information so I can verify the change took hold? Can openssl be used to query the certificate information?

I don't work with MQTT channels, but as long as you can poke an IBM MQ TLS port, you should be able to use openssl s_client to get the IBM MQ cert for the given channel. The following blog post goes into more details with using openssl s_client and talks about things like CERTLABL which needs to be taken into consideration when using this approach.

https://community.ibm.com/community/user/integration/blogs/tim-zielke1/2020/04/24/using-openssl-s-client-with-ibm-mq

------------------------------
Tim Zielke
------------------------------

For MQTT channels, key repository has to be specified in the properties file  mqxr_win/mqxr_unix properties file . REFRESH SECURITY TYPE(SSL) may not be applicable to MQTT channels. Ideally restart of the MQTT channels should have picked the new certificate. If problem is still there, check if there are any errors logged in mqxr error logs.

------------------------------
SAVITHA JOSHI
------------------------------

Unfortunately, since the client did not like my server cert, it was throwing errors and the MQXR logs rolled. All I saw was:

2/16/24 21:16:32.384  AMQCO1010E: An SSL Exception occurred when a client at '/10.192.4.7' attempted to connect to channel 'MQTTSChannel': javax.net.ssl.SSLException: Received fatal alert: certificate_unknown.
2/16/24 21:16:32.384  AMQXR0021W: Client '' at network address '10.192.4.7' disconnected abnormally with exception 'Received fatal alert: certificate_unknown'.

Looks like the openssl s_client -connect localhost:8883 -showcerts command works and gives me back the server cert and CAs. I will just run that through openssl to get the information needed. Thanks!

FYI, this seems to work printing out the first cert and the information needed for port 8883.

openssl s_client -connect localhost:8883 -showcerts 2>/dev/null | awk '/BEGIN CERTIFICATE/{flag=1;print;next}/END CERTIFICATE/{flag=0;print;exit}flag' | openssl x509 -noout -issuer -subject -startdate -enddate