MQ

MQ

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Do I need to have personal certificate with label in keydb if any channels does not use ssl.

    Posted Tue August 26, 2025 09:16 AM
    Hello,
    server conn channel connecting to queue manager does not use any ssl, channel comes up running, can you please tell me why I am geting below in error log.
    ----- amqrmrsa.c : 628 --------------------------------------------------------
    08/25/2025 09:52:39 PM - Process(10850.807037) User(mqm) Program(amqrmppa)
                        Host(uq3600mq04) Installation(Installation1)
                        VRMF(9.4.0.5) QMgr(PQRXY)
                        Time(2025-08-26T01:52:39.190Z)
                        RemoteHost(132.0.0.0)
                        ArithInsert1(407)
                        CommentInsert1(????)
                        CommentInsert2(ibmwebspheremqpqrxy)
     
    AMQ9645E: Certificate label 'ibmwebspheremqpqrxy' not found for channel
    '????'.
     
    EXPLANATION:
    The local key database repository does not contain a certificate with label
    'ibmwebspheremqpqrxy'. The channel is '????'; in some cases its name
    cannot be determined and so is shown as '????'. The channel did not start.
     
    In some cases this message will appear multiple times, once for each affected
    channel.
    ACTION:
    Add a correctly labelled certificate to the local key database. Alternatively,
    change the certificate label configuration so that the channel uses a valid
    certificate.
     
    Restart the channel.



    ------------------------------
    K Priyanka
    ------------------------------


  • 2.  RE: Do I need to have personal certificate with label in keydb if any channels does not use ssl.

    Posted Tue August 26, 2025 06:55 PM

    Even though you mentioned the channel is not using SSL, MQ always checks for a personal certificate in the queue manager's key repository (KDB file)

    Your label is - ibmwebspheremqpqrxy 

    Mq checks for the certificate when channels start up, even if the channel definition has no SSL/TLS parameters. If it doesn't find it, we'll see this message in the error logs. In this case, we dont have any SSL enabled, and channels starts with no ssl handshake needed. 


    I guess, we can do the following to resolve,

    1) Add the required personal certificate. Create and import the cert into MQ KDBs file( Make sure you have lable ibmwebspheremqpqrxy in it) if you plan to use SSL/TLS.
    2) we can Ignore the error if you don't plan to use SSL/TLS
    3) Ensure that your channel definitions do not reference SSL/TLS (As long as there is no SSL enable, we can safely leave as is)



    ------------------------------
    Rashmitha Thukuntla
    ------------------------------

    Original Message


  • 3.  RE: Do I need to have personal certificate with label in keydb if any channels does not use ssl.

    Posted Wed August 27, 2025 09:27 AM

    Thank you,

    ignoring and error filling up the queue manager error log.

    Is it not okay to alter the queue manager and remove CERTLABL and SSLKEYR and keep it as empty?

     



    ------------------------------
    K Priyanka
    ------------------------------

    Original Message


  • 4.  RE: Do I need to have personal certificate with label in keydb if any channels does not use ssl.

    Posted Wed August 27, 2025 09:42 AM

    Error logs are recycled, so they don't fill up.
    Read this to suppress error messages https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=uel-suppressing-channel-error-messages-from-error-logs-multiplatforms



    ------------------------------
    bruce2359
    Consultant/trainer
    CTTECH - Computer & Telecommunications Technology
    West Coast, almost
    000-000-0000
    ------------------------------

    Original Message


  • 5.  RE: Do I need to have personal certificate with label in keydb if any channels does not use ssl.

    Posted Thu August 28, 2025 03:54 PM

    Option 4 - It sounds like the certificate label being referenced in the one in the CERTLABL attribute of the QMGR object.  You can always blank it out using the following MQSC command:

      echo "ALTER QMGR CERTLABL('') SSLKEYR('')" | runmqsc QMname

    Note: If you do this, it is probably a good idea to refresh security while you're at it.

      echo "REFRESH SECURITY TYPE(SSL)" | runmqsc QMname



    ------------------------------
    Bob
    ------------------------------

    Original Message


Related Content