I have the key  db set for 8.0.0.4   with the following permissions .  I am trying to start a client connection   with  ssl enabled .  
what could be the reason . 
setup is ok from keykb and  i  can list the certificates with the stashed password 

mtzhlgci02:/gci/system/sslcerts/cie2> ls -tl
total 44
-rw-r--r-- 1 cie gciteam 80 Nov 25 00:31 key.rdb
-rw-r--r-- 1 cie gciteam 129 Nov 25 00:31 key.sth
-rw-r--r-- 1 cie gciteam 25088 Nov 25 00:31 key.kdb

key repository is mentioned as /gci/system/sslcerts/cie2/key

but i get error in connecting  to the MQ QMGR when using MQCONNX c library 


AMQ9660: SSL key repository: password stash file absent or unusable.

EXPLANATION:
The SSL key repository cannot be used because MQ cannot obtain a password to
access it. Reasons giving rise to this error include:
(a) the key database file and password stash file are not present in the
location configured for the key repository,
(b) the key database file exists in the correct place but that no password
stash file has been created for it,
(c) the files are present in the correct place but the userid under which MQ is
running does not have permission to read them,
(d) one or both of the files are corrupt.

The channel is 'CIE.TEST.SVRCONN.SSL'; in some cases its name cannot be
determined and so is shown as '????'. The channel did not start.
ACTION:
Ensure that the key repository variable is set to where the key database file
is. Ensure that a password stash file has been associated with the key database
file in the same directory, and that the userid under which MQ is running has
read access to both files. If both are already present and readable in the
correct place, delete and recreate them. Restart the channel.



------------------------------
lakshmi saraswathi
------------------------------

You don't mention what user ID (and group) you are running the client program with, and you have trimmed the error log contents so that we cannot see this information there either.

The user ID (and group) that you are running the client program with needs to have read access to the KDB file. This is suggestion (c) in the error message explanation. Does it have access in your environment?

Cheers,
Morag

------------------------------
Morag Hughson
MQ Technical Education Specialist
MQGem Software Limited
Website: https://www.mqgem.com
------------------------------

Hello,

there is an issue that I can see that is a security weakness, but probably not the cause of your problem.

Your keystore is readable by world. That means that anybody with a login on that machine may be able to export and decrypt the private key, thus compromising your client identity. Some security software will refuse to use files with this sort of permissions error. I can't recall whether gskit cares or not.

You may of course be protecting this with directory permissions, but it would still be an improvement to set permissions here to 600 and ensure that the keystore is owned by the client userid.

As to your problem, I do recall one fix in the past (I note that your MQ version is quite old). On some platforms, the gskit runtime had problems with reading stash files created with runmqakm, but would work fine if the stash file was created with runmqckm or strmqikm.

I can't find the fix description right now, so I'm not sure which versions and platforms were affected, and you might not be using runmqakm anyway. But if the stash was created with runmqakm, you might try using runmqckm to recreate it, and see if that helps.

Regards,

------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334
------------------------------

Thank you for the feedback. Problem is fixed . There was LF  character in the repository  name and hence was not explicitly visible  . Hecne the error .

------------------------------
lakshmi saraswathi
------------------------------