HI Team,

Can you please help us to fix this issue. Thanks in advance. We are facing the issue with IBM MQ client to Server connect with .NET framework with mTLS. we are using below .kdb approach  to generate a kdb file.

 (This is at my local side configuration) : kdb store generation command:

Below is my .NET code:

static void Main(string[] args)
{
    string host = ConfigurationManager.AppSettings["Hostname"];
    int port = Convert.ToInt32(ConfigurationManager.AppSettings["Port"]);
    string queueManager = ConfigurationManager.AppSettings["QueueManagerName"];
    string channel = ConfigurationManager.AppSettings["ChannelName"];
    string queueName = ConfigurationManager.AppSettings["QueueName"];
    string cipherSpec = ConfigurationManager.AppSettings["CipherSpec"];
    string connectionName = ConfigurationManager.AppSettings["ConnectionName"];

    XMSFactoryFactory factoryFactory = XMSFactoryFactory.GetInstance(XMSC.CT_WMQ);
    IConnectionFactory cf = factoryFactory.CreateConnectionFactory();

    cf.SetIntProperty(XMSC.WMQ_CONNECTION_MODE, XMSC.WMQ_CM_CLIENT_UNMANAGED);
    cf.SetStringProperty(XMSC.WMQ_QUEUE_MANAGER, queueManager);
    cf.SetStringProperty(XMSC.WMQ_CHANNEL, channel);

    if (!string.IsNullOrWhiteSpace(connectionName))
        cf.SetStringProperty(XMSC.WMQ_CONNECTION_NAME_LIST, connectionName.Trim());
    else
    {
        cf.SetStringProperty(XMSC.WMQ_HOST_NAME, host);
        cf.SetIntProperty(XMSC.WMQ_PORT, port);
    }

    ApplySslKdb(cf, cipherSpec);

    string queueUri = queueName.StartsWith("queue:///", StringComparison.OrdinalIgnoreCase)
        ? queueName
        : "queue:///" + queueName.TrimStart('/');

    IConnection connection;
    try
    {
        connection = cf.CreateConnection();
    }
    catch (XMSException ex)
    {
        if (ex.Message != null && ex.Message.IndexOf("2381", StringComparison.Ordinal) >= 0)
            Console.WriteLine(Environment.NewLine + Build2381Help());
        throw;
    }
}

static void ApplySslKdb(IConnectionFactory cf, string cipherSpec)
{
    try
    {
        if (string.IsNullOrWhiteSpace(cipherSpec))
            return;

        string keyDatabasePath = ConfigurationManager.AppSettings["KeyDatabasePath"];
        string repositoryPassword = ConfigurationManager.AppSettings["KeyRepositoryPassword"];
        string certificateLabel = ConfigurationManager.AppSettings["CertificateLabel"];
        string peerName = ConfigurationManager.AppSettings["PeerName"];

        if (string.IsNullOrWhiteSpace(keyDatabasePath))
            throw new InvalidOperationException("MqConnection.CipherSpec is set but Ssl.KeyDatabasePath is missing.");

        string keyRepoForMq = NormalizeKeyRepositoryPath(keyDatabasePath.Trim());
        ValidateKdbFilesExist(keyRepoForMq);

        cf.SetStringProperty(XMSC.WMQ_SSL_CIPHER_SPEC, cipherSpec.Trim());
        cf.SetStringProperty(XMSC.WMQ_SSL_KEY_REPOSITORY, keyRepoForMq);

        if (!string.IsNullOrEmpty(repositoryPassword))
            cf.SetStringProperty(XMSC.WMQ_SSL_KEY_REPOSITORY_PASSWORD, repositoryPassword);

        if (!string.IsNullOrWhiteSpace(certificateLabel))
            cf.SetStringProperty(XMSC.WMQ_SSL_CLIENT_CERT_LABEL, certificateLabel.Trim());

        if (!string.IsNullOrWhiteSpace(peerName))
            cf.SetStringProperty(XMSC.WMQ_SSL_PEER_NAME, peerName.Trim());

    }
    catch (Exception ex)
    {
        throw;
    }
}


/// <summary>IBM MQ expects the key repository path without the .kdb suffix.</summary>
static string NormalizeKeyRepositoryPath(string path)
{
    string trimmed = path.Trim().TrimEnd('\\');
    if (trimmed.EndsWith(".kdb", StringComparison.OrdinalIgnoreCase))
        return trimmed.Substring(0, trimmed.Length - 4);
    return trimmed;
}

static void ValidateKdbFilesExist(string keyRepoNoExtension)
{
    string kdb = keyRepoNoExtension + ".kdb";
    if (!File.Exists(kdb))
        throw new FileNotFoundException("GSKit key database not found (.kdb). Check Ssl.KeyDatabasePath (path without .kdb).", kdb);

    string sth = keyRepoNoExtension + ".sth";
    if (!File.Exists(sth) && string.IsNullOrEmpty(AppSetting("KeyRepositoryPassword", "")))
        Console.WriteLine($"Note: no stash file {sth} and no KeyRepositoryPassword - connection may fail if a password is required.");
}

Below are the MQ server Configuration which we have taken from server:

I have attached everything here, Can someone help me to fic this error (MQCONNX ended with reason code 2393) when connecting mTLS enabled queue.

Best Regards,

Anil Chaudhary & @Dinesh Gandhi