MQ

MQ

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Graphical interface to manager key stores?

  • 1.  Graphical interface to manager key stores?

    Posted Tue September 03, 2024 11:38 AM

    Hi all

    MQ v9.4 removed the graphical interface to manage keystores, is there a replacement, non command line? 

    Thanks



    ------------------------------
    Joao Ramires
    ------------------------------


  • 2.  RE: Graphical interface to manager key stores?

    Posted Wed September 04, 2024 04:12 AM

    Hi Joao,

    The graphical interface that was shipped with IBM MQ previously was provided by the JRE that was shipped with IBM MQ. In 9.4 we moved to a newer version of the JRE that unfortunately did not supply this anymore. There is no replacement available in our third party tools that we ship with IBM MQ.

    It looks like there are options available online such as keystore explorer but these are outside of IBM's control.



    ------------------------------
    Rob Parker
    Security Architect, IBM MQ Distributed
    IBM UK Ltd
    ------------------------------

    Original Message


  • 3.  RE: Graphical interface to manager key stores?

    Posted Wed September 04, 2024 04:37 AM

    Hello,

    The main problem is KDB files . As far as I know this format is IBM only and keystore explorer does not support it.



    ------------------------------
    Yulia Vaisman
    ------------------------------

    Original Message


  • 4.  RE: Graphical interface to manager key stores?

    Posted Thu September 05, 2024 01:08 AM

    Hello Yulia,

    Please check out the command line tools runmqakm and runmqckm. They are quite easy to use, just append -? to your list of parameters and help will be provided.

    They are essential anyways when looking at container environment as graphical tools will not work in the CICD devops environment (unless used headless)...

    Hope it helps



    ------------------------------
    Francois Brandelik
    ------------------------------

    Original Message


  • 5.  RE: Graphical interface to manager key stores?

    Posted Thu September 05, 2024 03:05 AM

    Francois,

    For automatic processes of course it's possible to use   command line tools . But if you want to check kdb file GUI interface is better . You can copy/move/rename a file with DOS commands but most people do it with file explorer .



    ------------------------------
    Yulia Vaisman
    ------------------------------

    Original Message


  • 6.  RE: Graphical interface to manager key stores?

    Posted Sun September 08, 2024 01:13 AM

    Hi Yulia,

    I've been having a quick tinker with creating a small Python app that essentially wraps the runmqakm commands in a GUI. If you'd find that of interest please do get in touch. It's a little bit rough around the edges at the moment because it's just a PoC, but if you'd like to help me whip it into shape and then we could let the community have it, I'd be happy to work with you.

    Here's a screenshot of the basic view.

    Cheers,
    Morag



    ------------------------------
    Morag Hughson
    MQ Technical Education Specialist
    MQGem Software Limited
    Website: https://www.mqgem.com
    ------------------------------

    Original Message


  • 7.  RE: Graphical interface to manager key stores?

    Posted Sun September 08, 2024 02:09 AM

    Hello,

    I have no problem to help but my background is MF. I have no Python  development skills . 



    ------------------------------
    Yulia Vaisman
    ------------------------------

    Original Message


  • 8.  RE: Graphical interface to manager key stores?

    Posted Sun September 08, 2024 04:54 AM

    My background is MF too, and I had no Python development skills either until a year or so ago. However, I was thinking you could help by letting me know which tasks were needed - I have no intention of wrapping every possible runmqakm option! And also by testing it. This would mean you would need Python installed, but no development skills needed. I haven't tried out all the error paths and could do with help in covering that.

    If you're interested, perhaps you can contact me directly - see here for my email address.

    Cheers,
    Morag



    ------------------------------
    Morag Hughson
    MQ Technical Education Specialist
    MQGem Software Limited
    Website: https://www.mqgem.com
    ------------------------------

    Original Message


  • 9.  RE: Graphical interface to manager key stores?

    Posted Mon September 09, 2024 10:11 AM

    Hi Morag:

    To be clear:

    If I already have the gui, can I move it to another location, and continue to use with 9.4?

    RE: KDB: Doesn't 9.,4 allow the use of jks or p12?

    Thanks



    ------------------------------
    Anthony Julian
    ------------------------------

    Original Message


  • 10.  RE: Graphical interface to manager key stores?

    Posted Tue September 10, 2024 01:02 AM
    Edited by Morag Hughson Tue September 10, 2024 01:02 AM

    Hi Tony,

    I'll let @Rob Parker answer officially from IBM on the question of moving the iKeyMan GUI from an earlier MQ release and using it with V9.4.0 and onwards.

    wrt alternatives to KBD, yes IBM MQ from V9.3.0 can use a PKCS#12 as it's Key Repository as an alternative to a KDB. Read more in this blog post by Rob Parker.

    I don't believe the queue manager can use a JKS though.

    Cheers,
    Morag



    ------------------------------
    Morag Hughson
    MQ Technical Education Specialist
    MQGem Software Limited
    Website: https://www.mqgem.com
    ------------------------------

    Original Message


  • 11.  RE: Graphical interface to manager key stores?

    Posted Tue September 10, 2024 03:47 AM

    Sadly i don't think it would be possible to move the ikeyman gui to newer releases and have it still work. Especially once the Java version shipped with IBM MQ is upgraded. Technically, right now it is still there, it's just strmqikm, runmqckm that have been removed. But this is going to change within the MQ 9.4 LTS and CD lifetime.

    It is likely better to convert your keystores to PKCS#12 as this will allow your queue manager and java programs to access them. In fact, from 9.4 LTS/CD it is a requirement that the queue manager uses a PKCS#12 keystore if you plan to use AMQP. You can convert a keystore from CMS to PKCS#12 format using the command: 

    runmqakm -keydb -convert -db <old.kdb> -pw <password>|-stashed -type cms -new_db <new.p12> -new_format pkcs12

    Finally, no, a queue manager cannot use a JKS keystore. We're limited to the keystore type of the underlying crypto library. Commonly the keystore format is CMS or PKCS#12.



    ------------------------------
    Rob Parker
    Security Architect, IBM MQ Distributed
    IBM UK Ltd
    ------------------------------

    Original Message