Hi,
I'm struggling to setup SSL security between 2 servers:
Server 1: MQ MFT QManager + coordinator + command + FileLogger (I have only one QManager on which I set the coordinator and the command)
Server 2: MQ MFT Agent 
All under Redhat Linux 8 and using MQ MFT v9.2

The infrastructure is working fine WITHOUT SSL and beeing able to transfer files from one folder on the Agent to another folder on the same agent.

With SSL:
I succeeded to set the SSL between the Agent and the QManager and run fteStartAgent command properly on the agent side  but the coordinator and the command are not connecting with RC=2397 and error message AMQ9771
I configured coordination.properties and command.properties with params similar to agent.properties without success.
Anyone went thru such an issue ?
Thanks for your support.

------------------------------
Mustapha Ennaifar
------------------------------

Hi Mustapha 

I notice that the Agent is on a different server to the coordinator and command. Do the coordinator and command JVMs have access to the same key and trust stores as the agent? 

Being on different servers they would need to have access to a copy of the stores on Server 1.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334
------------------------------

Hi Neil, 
Thank you for your reply and support.
I'm not sure to understand correctly what you said. (in your last sentence: "Being on different servers they would need to have access to a copy of the stores on Server 1." do you mean Server 1 or Server 2 ?

In my setup
Server 1:
I generated Private key (KeyStore). QManager, Coordinator and Command have access to this KeyStore
The Public Key (with label: ibmwebspheremqmftu (mftu is the name of my QM)  is sent to the server 2

Server 2:
I have only a TrustStore (with the public key of the Server 1). No private Key is generated for the agent.

My understanding:
An SSL/TLS connection need to be set between the Agent (Server 2) and the Coordinator (Server 1) and also between the Agent (Server 2) and the Command (Server1).
Please clarify If I'm wrong ?
Thank you

------------------------------
Mustapha Ennaifar
------------------------------

Original Message:
Sent: Wed November 18, 2020 02:14 AM
From: Neil Casey
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Mustapha 

I notice that the Agent is on a different server to the coordinator and command. Do the coordinator and command JVMs have access to the same key and trust stores as the agent? 

Being on different servers they would need to have access to a copy of the stores on Server 1.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334
------------------------------

Hi Mustapha,

I'm sorry... I should have reviewed your email and the MFT architecture before writing my original response. I was thinking of the command and coordination you referred to as processes, but of course they are actually just queue manager roles.

I have some questions to try to understand your situation better.

As I understand it, you now have an Agent running on Server2, communicating with the queue manager (running as an MFT agent queue manager) which is running on Server1. The connection is MQI client channel with TLS and presumably using user/password authentication since you are not using client side certificates. You must have SSLCAUTH(OPTIONAL) since there is no personal certificate on the Agent side.

It sounds like you are then trying to run commands on Server2 to initiate a transfer. The command (such as fteCreateTransfer) needs to connect using a client channel to the command queue manager (the same queue manager on Server1) but this connection is failing.

Is that right?

If that's what is happening, have you checked the /var/mqm/errors/AMQERR01.LOG file on Server2? It should contain detailed messages related to why the client connection failed.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334
------------------------------

Original Message:
Sent: Wed November 18, 2020 08:39 AM
From: Mustapha Ennaifar
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Neil, 
Thank you for your reply and support.
I'm not sure to understand correctly what you said. (in your last sentence: "Being on different servers they would need to have access to a copy of the stores on Server 1." do you mean Server 1 or Server 2 ?

In my setup
Server 1:
I generated Private key (KeyStore). QManager, Coordinator and Command have access to this KeyStore
The Public Key (with label: ibmwebspheremqmftu (mftu is the name of my QM)  is sent to the server 2

Server 2:
I have only a TrustStore (with the public key of the Server 1). No private Key is generated for the agent.

My understanding:
An SSL/TLS connection need to be set between the Agent (Server 2) and the Coordinator (Server 1) and also between the Agent (Server 2) and the Command (Server1).
Please clarify If I'm wrong ?
Thank you

------------------------------
Mustapha Ennaifar
------------------------------


Original Message:
Sent: Wed November 18, 2020 02:14 AM
From: Neil Casey
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Mustapha 

I notice that the Agent is on a different server to the coordinator and command. Do the coordinator and command JVMs have access to the same key and trust stores as the agent? 

Being on different servers they would need to have access to a copy of the stores on Server 1.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334

Thank you Neil for your feedback
The only thing I will correct is: I'm not setting authentication (user/password). I need to run (first) the SSL/TLS before going to activate authentication.
All the rest what you described is correct.

In the  /var/mqm/errors/AMQERR01.LOG file on Server2, I see the below ... 
I will investigate what it is.
If you have an idea on this please do not hesitate ...
Thank you again for you support.


----- amqrcdfa.c : 619 --------------------------------------------------------
11/12/2020 10:36:30 PM - Process(5137.1) User(mqm) Program(runmqsc)
Host(localhost.localdomain) Installation(Installation1)
VRMF(9.2.0.0)
Time(2020-11-12T21:36:30.833Z)
ArithInsert1(24948) ArithInsert2(2)
CommentInsert1(/opt/mqm/lib64/libmqmr_r.so)
CommentInsert2(No such file or directory)
CommentInsert3(64)

AMQ6174I: The dynamically loadable shared library '/opt/mqm/lib64/libmqmr_r.so'
could not be loaded. The system returned error number '2' and error message 'No
such file or directory'.

EXPLANATION:
This message applies to UNIX systems. The shared library
'/opt/mqm/lib64/libmqmr_r.so' could not be loaded.
ACTION:
Check that the file exists, and is either fully qualified or is in the
appropriate director, also check the file access permissions.
----- amqxufnx.c : 1459 -------------------------------------------------------
11/12/2020 10:36:30 PM - Process(5137.1) User(mqm) Program(runmqsc)
Host(localhost.localdomain) Installation(Installation1)
VRMF(9.2.0.0)
Time(2020-11-12T21:36:30.839Z)
ArithInsert1(1013)
CommentInsert1(/var/mqm/AMQCLCHL.TAB)

AMQ9518E: File '/var/mqm/AMQCLCHL.TAB' not found.

EXPLANATION:
The program requires that the file '/var/mqm/AMQCLCHL.TAB' is present and
available.
ACTION:
This error may be caused by the program specifying an incorrect file location
programmatically via MQCNO value through CCDTUrlPtr or CCDTUrlOffset. If the
program has not specified the file location, the environment variables
MQCHLLIB, MQCHLTAB or MQCCDTURL may have been specified. If none of these
environment variables are set, the location of the file may have been specified
in the mqclient.ini through ChannelDefinitionDirectory and
ChannelDefinitionFile attributes under the Channels stanza. If the location was
not configured programmatically, by environment variable or by mqclient.ini
values then '/var/mqm/AMQCLCHL.TAB' represents a default location and filename
for this installation. Ensure that file location is correctly configured and
that the file is available to the program.
----- amqrcdfa.c : 619 --------------------------------------------------------



------------------------------
Mustapha Ennaifar
------------------------------

Original Message:
Sent: Wed November 18, 2020 05:05 PM
From: Neil Casey
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Mustapha,

I'm sorry... I should have reviewed your email and the MFT architecture before writing my original response. I was thinking of the command and coordination you referred to as processes, but of course they are actually just queue manager roles.

I have some questions to try to understand your situation better.

As I understand it, you now have an Agent running on Server2, communicating with the queue manager (running as an MFT agent queue manager) which is running on Server1. The connection is MQI client channel with TLS and presumably using user/password authentication since you are not using client side certificates. You must have SSLCAUTH(OPTIONAL) since there is no personal certificate on the Agent side.

It sounds like you are then trying to run commands on Server2 to initiate a transfer. The command (such as fteCreateTransfer) needs to connect using a client channel to the command queue manager (the same queue manager on Server1) but this connection is failing.

Is that right?

If that's what is happening, have you checked the /var/mqm/errors/AMQERR01.LOG file on Server2? It should contain detailed messages related to why the client connection failed.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334
------------------------------


Original Message:
Sent: Wed November 18, 2020 08:39 AM
From: Mustapha Ennaifar
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Neil, 
Thank you for your reply and support.
I'm not sure to understand correctly what you said. (in your last sentence: "Being on different servers they would need to have access to a copy of the stores on Server 1." do you mean Server 1 or Server 2 ?

In my setup
Server 1:
I generated Private key (KeyStore). QManager, Coordinator and Command have access to this KeyStore
The Public Key (with label: ibmwebspheremqmftu (mftu is the name of my QM)  is sent to the server 2

Server 2:
I have only a TrustStore (with the public key of the Server 1). No private Key is generated for the agent.

My understanding:
An SSL/TLS connection need to be set between the Agent (Server 2) and the Coordinator (Server 1) and also between the Agent (Server 2) and the Command (Server1).
Please clarify If I'm wrong ?
Thank you

------------------------------
Mustapha Ennaifar


Original Message:
Sent: Wed November 18, 2020 02:14 AM
From: Neil Casey
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Mustapha 

I notice that the Agent is on a different server to the coordinator and command. Do the coordinator and command JVMs have access to the same key and trust stores as the agent? 

Being on different servers they would need to have access to a copy of the stores on Server 1.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334

Hi Mustapha 

I wouldn't worry about the missing library. It is a server library for accessing MQ when running on the same machine as the queue manager. Most likely the code is trying to determine whether it can reach a local queue manager instead of using a client connection.

It looks like it then tries to connect using client, but the configuration that's in place requires access to a client channel table (AMQCLCHL.TAB).

It looks as though it is looking for this in the default location, so you have probably never configured it, and perhaps have never created one.

I don't know why the client code is looking for a channel table. That would depend on how your client system is configured. Perhaps there is an item configured in the config file that specifies the channel table file?

Best of luck.

Neil.

------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334
------------------------------

Original Message:
Sent: Thu November 19, 2020 03:41 AM
From: Mustapha Ennaifar
Subject: Setup SSL/TLS for MQ MFT v9.2

Thank you Neil for your feedback
The only thing I will correct is: I'm not setting authentication (user/password). I need to run (first) the SSL/TLS before going to activate authentication.
All the rest what you described is correct.

In the  /var/mqm/errors/AMQERR01.LOG file on Server2, I see the below ... 
I will investigate what it is.
If you have an idea on this please do not hesitate ...
Thank you again for you support.


----- amqrcdfa.c : 619 --------------------------------------------------------
11/12/2020 10:36:30 PM - Process(5137.1) User(mqm) Program(runmqsc)
Host(localhost.localdomain) Installation(Installation1)
VRMF(9.2.0.0)
Time(2020-11-12T21:36:30.833Z)
ArithInsert1(24948) ArithInsert2(2)
CommentInsert1(/opt/mqm/lib64/libmqmr_r.so)
CommentInsert2(No such file or directory)
CommentInsert3(64)

AMQ6174I: The dynamically loadable shared library '/opt/mqm/lib64/libmqmr_r.so'
could not be loaded. The system returned error number '2' and error message 'No
such file or directory'.

EXPLANATION:
This message applies to UNIX systems. The shared library
'/opt/mqm/lib64/libmqmr_r.so' could not be loaded.
ACTION:
Check that the file exists, and is either fully qualified or is in the
appropriate director, also check the file access permissions.
----- amqxufnx.c : 1459 -------------------------------------------------------
11/12/2020 10:36:30 PM - Process(5137.1) User(mqm) Program(runmqsc)
Host(localhost.localdomain) Installation(Installation1)
VRMF(9.2.0.0)
Time(2020-11-12T21:36:30.839Z)
ArithInsert1(1013)
CommentInsert1(/var/mqm/AMQCLCHL.TAB)

AMQ9518E: File '/var/mqm/AMQCLCHL.TAB' not found.

EXPLANATION:
The program requires that the file '/var/mqm/AMQCLCHL.TAB' is present and
available.
ACTION:
This error may be caused by the program specifying an incorrect file location
programmatically via MQCNO value through CCDTUrlPtr or CCDTUrlOffset. If the
program has not specified the file location, the environment variables
MQCHLLIB, MQCHLTAB or MQCCDTURL may have been specified. If none of these
environment variables are set, the location of the file may have been specified
in the mqclient.ini through ChannelDefinitionDirectory and
ChannelDefinitionFile attributes under the Channels stanza. If the location was
not configured programmatically, by environment variable or by mqclient.ini
values then '/var/mqm/AMQCLCHL.TAB' represents a default location and filename
for this installation. Ensure that file location is correctly configured and
that the file is available to the program.
----- amqrcdfa.c : 619 --------------------------------------------------------



------------------------------
Mustapha Ennaifar
------------------------------


Original Message:
Sent: Wed November 18, 2020 05:05 PM
From: Neil Casey
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Mustapha,

I'm sorry... I should have reviewed your email and the MFT architecture before writing my original response. I was thinking of the command and coordination you referred to as processes, but of course they are actually just queue manager roles.

I have some questions to try to understand your situation better.

As I understand it, you now have an Agent running on Server2, communicating with the queue manager (running as an MFT agent queue manager) which is running on Server1. The connection is MQI client channel with TLS and presumably using user/password authentication since you are not using client side certificates. You must have SSLCAUTH(OPTIONAL) since there is no personal certificate on the Agent side.

It sounds like you are then trying to run commands on Server2 to initiate a transfer. The command (such as fteCreateTransfer) needs to connect using a client channel to the command queue manager (the same queue manager on Server1) but this connection is failing.

Is that right?

If that's what is happening, have you checked the /var/mqm/errors/AMQERR01.LOG file on Server2? It should contain detailed messages related to why the client connection failed.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334


Original Message:
Sent: Wed November 18, 2020 08:39 AM
From: Mustapha Ennaifar
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Neil, 
Thank you for your reply and support.
I'm not sure to understand correctly what you said. (in your last sentence: "Being on different servers they would need to have access to a copy of the stores on Server 1." do you mean Server 1 or Server 2 ?

In my setup
Server 1:
I generated Private key (KeyStore). QManager, Coordinator and Command have access to this KeyStore
The Public Key (with label: ibmwebspheremqmftu (mftu is the name of my QM)  is sent to the server 2

Server 2:
I have only a TrustStore (with the public key of the Server 1). No private Key is generated for the agent.

My understanding:
An SSL/TLS connection need to be set between the Agent (Server 2) and the Coordinator (Server 1) and also between the Agent (Server 2) and the Command (Server1).
Please clarify If I'm wrong ?
Thank you

------------------------------
Mustapha Ennaifar


Original Message:
Sent: Wed November 18, 2020 02:14 AM
From: Neil Casey
Subject: Setup SSL/TLS for MQ MFT v9.2

Hi Mustapha 

I notice that the Agent is on a different server to the coordinator and command. Do the coordinator and command JVMs have access to the same key and trust stores as the agent? 

Being on different servers they would need to have access to a copy of the stores on Server 1.

Regards,



------------------------------
Neil Casey
Senior Consultant
Syntegrity Solutions
Melbourne, Victoria
IBM Champion (Cloud) 2019-20
+61 (0) 414 615 334