If the client is intended to be anonymous, then the SVRCONN that it is connecting to must be defined to use SSLCAUTH(OPTIONAL).

If the SVRCONN that the client is connecting to is mandated to use SSLCAUTH(REQUIRED) then your client cannot be anonymous and you will need a certificate identifying the client, the CA of which will need to be in the queue manager KDB.

Cheers,
Morag

Hi @Morag Hughson,

If I need to enable mTLS and have set SSLCAUTH(REQUIRED) for the MQ channel, then I am also getting this in the MQ server logs - During handshake, the remote partner sent no certificate.

I read your inputs on this. So, I understand that we need to have it configured on client-side for the client public cert to be presented during Two-Way handshake, and also it needs to be stored on MQ server side as well for verification of client cert. I have done all these, still getting the aforementioned error. I am attching my Jms/SSL Config code for your ref. Your assistance will be massively appreciated:

    @Bean
    public SSLSocketFactory sslSocketFactory() throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
        String storeType = System.getProperty("javax.net.ssl.keyStoreType", KeyStore.getDefaultType());
        // Key Manager Factory
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        char[] tsPwdBytes = CLIENT_TRUSTSTORE_PASSWORD.toCharArray();
        char[] ksPwdBytes = CLIENT_KEYSTORE_PASSWORD.toCharArray();
        String truststorePath = BASE_DIR_CERT+"client_truststore.jks";
        String keystorePath = BASE_DIR_CERT+"ks\\client_keystore.jks";
        // configure TS
        initTMF(truststorePath, tsPwdBytes, tmf);
        // configure KS
        initKMF(keystorePath, ksPwdBytes, kmf);
        try {
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
            return sslContext.getSocketFactory();
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            log.error("Exception occurred while SSLContext init: ", e);
            throw new RuntimeException(e);
        }
    }

    private static void initTMF(String truststorePath, char[] tsPwdBytes, TrustManagerFactory tmf) throws KeyStoreException {
        KeyStore trustStore = KeyStore.getInstance(DEFAULT_STORE_TYPE);
        try (FileInputStream fis = new FileInputStream(truststorePath)) {
            trustStore.load(fis, tsPwdBytes);
        } catch (FileNotFoundException e) {
            log.error("Exception occurred while file path search: ", e);
            throw new RuntimeException(e);
        } catch (IOException e) {
            log.error("Exception occurred while file read: ", e);
            throw new RuntimeException(e);
        } catch (CertificateException e) {
            log.error("Exception occurred with Certificate: ", e);
            throw new RuntimeException(e);
        } catch (NoSuchAlgorithmException e) {
            log.error("Exception occurred with KeyAlgo: ", e);
            throw new RuntimeException(e);
        }
        tmf.init(trustStore);
    }

    private static void initKMF(String keystorePath, char[] ksPwdBytes, KeyManagerFactory kmf) throws KeyStoreException, UnrecoverableKeyException, NoSuchAlgorithmException {
        KeyStore keyStore = KeyStore.getInstance(DEFAULT_STORE_TYPE);
        try (FileInputStream fis = new FileInputStream(keystorePath)) {
            keyStore.load(fis, ksPwdBytes);
        } catch (FileNotFoundException e) {
            log.error("Exception occurred while file path search: ", e);
            throw new RuntimeException(e);
        } catch (IOException e) {
            log.error("Exception occurred while file read: ", e);
            throw new RuntimeException(e);
        } catch (CertificateException e) {
            log.error("Exception occurred with Certificate: ", e);
            throw new RuntimeException(e);
        } catch (NoSuchAlgorithmException e) {
            log.error("Exception occurred with KeyAlgo: ", e);
            throw new RuntimeException(e);
        }
        kmf.init(keyStore, ksPwdBytes);
    }

    @Bean
    public MQQueueConnectionFactory mqConnectionFactory(SSLSocketFactory sslSocketFactory) throws Exception {
        /**
         * Configure SSL properties
          */
        System.setProperty("com.ibm.mq.cfg.useIBMCipherMappings", "false");
        MQQueueConnectionFactory factory = new MQQueueConnectionFactory();
        factory.setHostName("localhost");
        factory.setPort(1414);
        factory.setQueueManager("QM1");
        //factory.setChannel("DEV.APP.SVRCONN");
        factory.setChannel("DEV.ADMIN.SVRCONN");
        //factory.setTransportType(1); // 1 for Client
        factory.setTransportType(WMQConstants.WMQ_CM_CLIENT);
        // Set the SSLContext in the connection factory
        factory.setSSLSocketFactory(sslSocketFactory);
        // ssl configs
        factory.setSSLCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA256");

        // Setting username and password
        factory.setStringProperty(WMQConstants.USERID, "admin"); // Replace with your actual username
        factory.setStringProperty(WMQConstants.PASSWORD, "passw0rd"); // Replace with your actual password
        return factory;
    }

    private static MQQueueConnectionFactory getMqQueueConnectionFactory(SSLSocketFactory sslSocketFactory) throws JMSException {
        MQQueueConnectionFactory factory = new MQQueueConnectionFactory();
        factory.setHostName("localhost");
        factory.setPort(1414);
        factory.setQueueManager("QM1");
        //factory.setChannel("DEV.APP.SVRCONN");
        factory.setChannel("DEV.ADMIN.SVRCONN");
        //factory.setTransportType(1); // 1 for Client
        factory.setTransportType(WMQConstants.WMQ_CM_CLIENT);
        // Set the SSLContext in the connection factory
        factory.setSSLSocketFactory(sslSocketFactory);
        // ssl configs
        factory.setSSLCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA256");
        // Setting username and password
        factory.setStringProperty(WMQConstants.USERID, "admin"); // Replace with your actual username
        factory.setStringProperty(WMQConstants.PASSWORD, "passw0rd"); // Replace with your actual password
        return factory;
    }

Hi @Piyush Ojha,

Unfortunately your code does not help me to understand the contents of your keystore and truststore, only that you are using a JKS type of store.

You say that you have "configured on client-side for the client public cert to be presented during Two-Way handshake, and also it needs to be stored on MQ server side as well for verification of client cert."

Could you elaborate on how you have configured this please? For example, can you show us the commands that you have used to populate your JKS store with the client certificate that it should be presenting to the queue manager? That would help us to diagnose what might be going wrong here.

Cheers,
Morag

    @Bean    public SSLSocketFactory sslSocketFactory() throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {        String storeType = System.getProperty("javax.net.ssl.keyStoreType", KeyStore.getDefaultType());        // Key Manager Factory        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());        char[] tsPwdBytes = CLIENT_TRUSTSTORE_PASSWORD.toCharArray();        char[] ksPwdBytes = CLIENT_KEYSTORE_PASSWORD.toCharArray();        String truststorePath = BASE_DIR_CERT+"client_truststore.jks";        String keystorePath = BASE_DIR_CERT+"ks\\client_keystore.jks";        // configure TS        initTMF(truststorePath, tsPwdBytes, tmf);        // configure KS        initKMF(keystorePath, ksPwdBytes, kmf);        try {            SSLContext sslContext = SSLContext.getInstance("TLS");            sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);            return sslContext.getSocketFactory();        } catch (NoSuchAlgorithmException | KeyManagementException e) {            log.error("Exception occurred while SSLContext init: ", e);            throw new RuntimeException(e);        }    }    private static void initTMF(String truststorePath, char[] tsPwdBytes, TrustManagerFactory tmf) throws KeyStoreException {        KeyStore trustStore = KeyStore.getInstance(DEFAULT_STORE_TYPE);        try (FileInputStream fis = new FileInputStream(truststorePath)) {            trustStore.load(fis, tsPwdBytes);        } catch (FileNotFoundException e) {            log.error("Exception occurred while file path search: ", e);            throw new RuntimeException(e);        } catch (IOException e) {            log.error("Exception occurred while file read: ", e);            throw new RuntimeException(e);        } catch (CertificateException e) {            log.error("Exception occurred with Certificate: ", e);            throw new RuntimeException(e);        } catch (NoSuchAlgorithmException e) {            log.error("Exception occurred with KeyAlgo: ", e);            throw new RuntimeException(e);        }        tmf.init(trustStore);    }    private static void initKMF(String keystorePath, char[] ksPwdBytes, KeyManagerFactory kmf) throws KeyStoreException, UnrecoverableKeyException, NoSuchAlgorithmException {        KeyStore keyStore = KeyStore.getInstance(DEFAULT_STORE_TYPE);        try (FileInputStream fis = new FileInputStream(keystorePath)) {            keyStore.load(fis, ksPwdBytes);        } catch (FileNotFoundException e) {            log.error("Exception occurred while file path search: ", e);            throw new RuntimeException(e);        } catch (IOException e) {            log.error("Exception occurred while file read: ", e);            throw new RuntimeException(e);        } catch (CertificateException e) {            log.error("Exception occurred with Certificate: ", e);            throw new RuntimeException(e);        } catch (NoSuchAlgorithmException e) {            log.error("Exception occurred with KeyAlgo: ", e);            throw new RuntimeException(e);        }        kmf.init(keyStore, ksPwdBytes);    }    @Bean    public MQQueueConnectionFactory mqConnectionFactory(SSLSocketFactory sslSocketFactory) throws Exception {        /**         * Configure SSL properties          */        System.setProperty("com.ibm.mq.cfg.useIBMCipherMappings", "false");        MQQueueConnectionFactory factory = new MQQueueConnectionFactory();        factory.setHostName("localhost");        factory.setPort(1414);        factory.setQueueManager("QM1");        //factory.setChannel("DEV.APP.SVRCONN");        factory.setChannel("DEV.ADMIN.SVRCONN");        //factory.setTransportType(1); // 1 for Client        factory.setTransportType(WMQConstants.WMQ_CM_CLIENT);        // Set the SSLContext in the connection factory        factory.setSSLSocketFactory(sslSocketFactory);        // ssl configs        factory.setSSLCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA256");        // Setting username and password        factory.setStringProperty(WMQConstants.USERID, "admin"); // Replace with your actual username        factory.setStringProperty(WMQConstants.PASSWORD, "passw0rd"); // Replace with your actual password        return factory;    }    private static MQQueueConnectionFactory getMqQueueConnectionFactory(SSLSocketFactory sslSocketFactory) throws JMSException {        MQQueueConnectionFactory factory = new MQQueueConnectionFactory();        factory.setHostName("localhost");        factory.setPort(1414);        factory.setQueueManager("QM1");        //factory.setChannel("DEV.APP.SVRCONN");        factory.setChannel("DEV.ADMIN.SVRCONN");        //factory.setTransportType(1); // 1 for Client        factory.setTransportType(WMQConstants.WMQ_CM_CLIENT);        // Set the SSLContext in the connection factory        factory.setSSLSocketFactory(sslSocketFactory);        // ssl configs        factory.setSSLCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA256");        // Setting username and password        factory.setStringProperty(WMQConstants.USERID, "admin"); // Replace with your actual username        factory.setStringProperty(WMQConstants.PASSWORD, "passw0rd"); // Replace with your actual password        return factory;    }

runmqakm -cert -list -db clientkey.kdb -stashed

Certificates found

* default, - personal, ! trusted, # secret key

! qm2cert

- ibmwebspheremqemir

I'm glad to hear that you got it working.

I just wanted to add that using a self-signed certificate to identify the client and then copying that client personal cert to the queue manager KDB is a practice that is not going to scale well. You'll have a lot of copying of certificates around to do if you have a lot of clients. If each client had a certificate signed by the same CA, then only that CA certificate would be needed in the queue manager KDB and you wouldn't have to import more certificates when you add more clients.

Just something to think about.

Cheers,
Morag