MQ

Hi Andres,

When you make a channel definition which refers to a certificate label as you have done:-

The certificate you refer to needs to exist in the key database file that the queue manager is using. You have shown us the contents of your key database file is thus:-

which does not appear to contain a certificate with a label of "ibmmqwebsphereremote" so that is why you are getting the error message saying:-

AMQ9645E: Certificate label 'ibmwebspheremqremote not found for channel 'REMOTE'.

You say "why i dont see the certlabel ibmmqwebsphereremote created?"

Are you expecting the queue manager to create this label for you? It will not - you must create it and put it in the key database file for the queue manager to find.

You say "it seems a bit tricky to find the correct name for the label".

Since you are using the CERTLABL attribute on the channel (and the same goes for the queue manager wide certificate) you can label your certificate any way you want. There is no longer any need to following the historic "ibmwebspheremq<qmgr-name>" style of label. Just make the label whatever you want and fill in that string in the CERTLABL attribute on the channel and/or queue manager.

It wasn't completely clear from your question why you were using the channel specific labels if you only need to connect QM1 to QM2 - it would be simpler if you could leave the channel CERTLABL attributes blank and have the channels make use of the queue manager wide certificate - which is specified in the queue manager object CERTLABL attribute.

P.S. If you do choose to continue with the historic pattern of label as you seem to have for the queue manager labels in your setup, please note that it is ibmwebspheremqqm1 and not ibmwebsphermqqm1 as you have - you're missing a letter 'e'.

Cheers,
Morag

Hi Morag,

My first problem is try to create a cert label that the CHANNEL is not finding.

Here is the doc im folllowing https://community.ibm.com/community/user/integration/discussion/connecting-2-queue-managers-with-ssl-amq9645e-certificate-label-not-found-for-channel-remote#bmd5c85d66-e1f0-4b9a-96f2-019513b00e4c

So i create the QM with the code i posted before:

Hi Andres,

When you make a channel definition which refers to a certificate label as you have done:-

The certificate you refer to needs to exist in the key database file that the queue manager is using. You have shown us the contents of your key database file is thus:-

which does not appear to contain a certificate with a label of "ibmmqwebsphereremote" so that is why you are getting the error message saying:-

AMQ9645E: Certificate label 'ibmwebspheremqremote not found for channel 'REMOTE'.

You say "why i dont see the certlabel ibmmqwebsphereremote created?"

Are you expecting the queue manager to create this label for you? It will not - you must create it and put it in the key database file for the queue manager to find.

You say "it seems a bit tricky to find the correct name for the label".

Since you are using the CERTLABL attribute on the channel (and the same goes for the queue manager wide certificate) you can label your certificate any way you want. There is no longer any need to following the historic "ibmwebspheremq<qmgr-name>" style of label. Just make the label whatever you want and fill in that string in the CERTLABL attribute on the channel and/or queue manager.

It wasn't completely clear from your question why you were using the channel specific labels if you only need to connect QM1 to QM2 - it would be simpler if you could leave the channel CERTLABL attributes blank and have the channels make use of the queue manager wide certificate - which is specified in the queue manager object CERTLABL attribute.

P.S. If you do choose to continue with the historic pattern of label as you seem to have for the queue manager labels in your setup, please note that it is ibmwebspheremqqm1 and not ibmwebsphermqqm1 as you have - you're missing a letter 'e'.

Cheers,
Morag

The link you provided for the doc you are following is a link to this thread - could you check and post the correct URL?

You appear to be telling me that you have asked for a certificate label to be created called "default"? And indeed I did see that label was in your key database file. So it seems that it has correctly made the certificate label that you requested. 

Both queue managers using a different CA is not a reason to use channel CERTLABLs. Just exchange the CA certificates so that the key database file for each queue manager contains the CA that signed the other queue manager's certificate and blank out the channel definition CERTLABL attributes.

Cheers,
Morag

Hi Morag,

My first problem is try to create a cert label that the CHANNEL is not finding.

Here is the doc im folllowing https://community.ibm.com/community/user/integration/discussion/connecting-2-queue-managers-with-ssl-amq9645e-certificate-label-not-found-for-channel-remote#bmd5c85d66-e1f0-4b9a-96f2-019513b00e4c

So i create the QM with the code i posted before:

Hi Andres,

When you make a channel definition which refers to a certificate label as you have done:-

The certificate you refer to needs to exist in the key database file that the queue manager is using. You have shown us the contents of your key database file is thus:-

which does not appear to contain a certificate with a label of "ibmmqwebsphereremote" so that is why you are getting the error message saying:-

AMQ9645E: Certificate label 'ibmwebspheremqremote not found for channel 'REMOTE'.

You say "why i dont see the certlabel ibmmqwebsphereremote created?"

Are you expecting the queue manager to create this label for you? It will not - you must create it and put it in the key database file for the queue manager to find.

You say "it seems a bit tricky to find the correct name for the label".

Since you are using the CERTLABL attribute on the channel (and the same goes for the queue manager wide certificate) you can label your certificate any way you want. There is no longer any need to following the historic "ibmwebspheremq<qmgr-name>" style of label. Just make the label whatever you want and fill in that string in the CERTLABL attribute on the channel and/or queue manager.

It wasn't completely clear from your question why you were using the channel specific labels if you only need to connect QM1 to QM2 - it would be simpler if you could leave the channel CERTLABL attributes blank and have the channels make use of the queue manager wide certificate - which is specified in the queue manager object CERTLABL attribute.

P.S. If you do choose to continue with the historic pattern of label as you seem to have for the queue manager labels in your setup, please note that it is ibmwebspheremqqm1 and not ibmwebsphermqqm1 as you have - you're missing a letter 'e'.

Cheers,
Morag

This is the link: https://www.ibm.com/docs/en/ibm-mq/9.2?topic=manager-example-configuring-tls

Yes, i create 2 cert label Default for the queue manager. Then im trying to create a cert label for the channels.

why im doing this? Probably because after doing some research i thought it was the correct way :).

I didnt know how the channel will pick up the certificate, so i decided to create the certfiicate label with a single key/crt

So now, i imported all the necesary CA authorities into "trust", in QM1:

pki:    keys:      - name: default        secret:          items:            - qm1.key            - qm1.crt            - qm1-ca-bundle.crt          secretName: test-qm1    trust:      - name: default        secret:          items:            - user-ca-bundle.crt            - qm1-ca-bundle.crt            - qm2-ca-bundle.crt          secretName: test-mq-ca

And similar for the second queue.

It seems to works now!

in RCVR qm2             
DIS CHSTATUS(REMOTE) ALL
     2 : DIS CHSTATUS(REMOTE) ALL
   CHANNEL(REMOTE)                         CHLTYPE(RCVR)
   SSLCERTI(CN=qm1 test self signed CA)
   SSLCIPH(TLS_CHACHA20_POLY1305_SHA256)   SSLKEYDA( )
   SSLKEYTI( )                          
   SSLPEER(SERIALNUMBER=00:94:EA:A8:B6:B5:22:C1:FD,CN=rb test qm)
   SSLRKEYS(0)                             STATUS(RUNNING)

and SDR from qm1

     2 : dis chstatus(REMOTE) all
AMQ8417I: Display Channel Status details.
   CHANNEL(REMOTE)                         CHLTYPE(SDR)
   CONNAME(10.20.67.6(1414))               
   RQMNAME(QM2)                  SHORTRTS(10)
   SECPROT(TLSV13)                      
   SSLCERTI(CN=qm1  test self signed CA)
   SSLCIPH(TLS_CHACHA20_POLY1305_SHA256)   SSLKEYDA( )
   SSLKEYTI( )                          
   SSLPEER(SERIALNUMBER=00:C3:F2:14:3E:32:FC:98:72,CN=qm2 test qm)
   SSLRKEYS(0)                             STATUS(RUNNING)
   STOPREQ(NO)                             SUBSTATE(MQGET)
   XBATCHSZ(0,0)                           XMITQ(TESTQMARION)
   XQTIME(0,0)                             RVERSION(09040101)
   RPRODUCT(MQMM) 

Thanks for your time!

The link you provided for the doc you are following is a link to this thread - could you check and post the correct URL?

You appear to be telling me that you have asked for a certificate label to be created called "default"? And indeed I did see that label was in your key database file. So it seems that it has correctly made the certificate label that you requested. 

Both queue managers using a different CA is not a reason to use channel CERTLABLs. Just exchange the CA certificates so that the key database file for each queue manager contains the CA that signed the other queue manager's certificate and blank out the channel definition CERTLABL attributes.

Cheers,
Morag

Hi Morag,

My first problem is try to create a cert label that the CHANNEL is not finding.

Here is the doc im folllowing https://community.ibm.com/community/user/integration/discussion/connecting-2-queue-managers-with-ssl-amq9645e-certificate-label-not-found-for-channel-remote#bmd5c85d66-e1f0-4b9a-96f2-019513b00e4c

So i create the QM with the code i posted before:

Hi Andres,

When you make a channel definition which refers to a certificate label as you have done:-

The certificate you refer to needs to exist in the key database file that the queue manager is using. You have shown us the contents of your key database file is thus:-

which does not appear to contain a certificate with a label of "ibmmqwebsphereremote" so that is why you are getting the error message saying:-

AMQ9645E: Certificate label 'ibmwebspheremqremote not found for channel 'REMOTE'.

You say "why i dont see the certlabel ibmmqwebsphereremote created?"

Are you expecting the queue manager to create this label for you? It will not - you must create it and put it in the key database file for the queue manager to find.

You say "it seems a bit tricky to find the correct name for the label".

Since you are using the CERTLABL attribute on the channel (and the same goes for the queue manager wide certificate) you can label your certificate any way you want. There is no longer any need to following the historic "ibmwebspheremq<qmgr-name>" style of label. Just make the label whatever you want and fill in that string in the CERTLABL attribute on the channel and/or queue manager.

It wasn't completely clear from your question why you were using the channel specific labels if you only need to connect QM1 to QM2 - it would be simpler if you could leave the channel CERTLABL attributes blank and have the channels make use of the queue manager wide certificate - which is specified in the queue manager object CERTLABL attribute.

P.S. If you do choose to continue with the historic pattern of label as you seem to have for the queue manager labels in your setup, please note that it is ibmwebspheremqqm1 and not ibmwebsphermqqm1 as you have - you're missing a letter 'e'.

Cheers,
Morag