MQ

 View Only
  • 1.  Mq client / .net framework / key repository

    Posted Mon February 12, 2024 08:27 AM
    I am struggling with this trying to do a simple ssl connection channel to a queue manager. Am using *SYSTEM for the repository since i put the server cert in there. From what i have been reading I believe my problem to be either finding the repository or finding the right cert. Using the P12 keystore on the server and correct mq lib for my app.. also using the latest version. Error was 2393..

    Thank you..


    Richard Rasmussen
    K2 Micro Systems


  • 2.  RE: Mq client / .net framework / key repository

    IBM Champion
    Posted Tue February 13, 2024 11:41 AM

    Using MQ with an iSeries is very similar to using it with other platforms.
    For example, for a link between a Queue Manager on i and an MQ client, you need a certificate on the i side and on the MQ client side (if you want mutual authentication).

    For SSL on i, I don't like to use *SYSTEM as a repository, preferring to create a classic certificate store, and deposit the Queue Manager certificate, the certification chain, and that of the MQ Client-side certificate if different.

    In the Queue Manager parameters, you need to specify the IFS path to the store, the store password and the certificate label to be used.

    On the MQ Client side, you need at least one store with the certification chain on the i side, and the client certificate and its chain if necessary.

    What errors do you encounter?

    HTH, LMD.



    ------------------------------
    Luc-Michel Demey
    DEMEY CONSULTING
    lmd@demey-consulting.fr
    #IBMChampion
    ------------------------------



  • 3.  RE: Mq client / .net framework / key repository

    Posted Thu February 15, 2024 02:22 PM

    Somehow, I finally have tracing working and am including here part of the trace file.  I think its either a problem with the cert I copied to my workstation or the security settings at the server for the channel and the qmgr...  I don't need the client sending a cert to the server - if that can be avoided great!  My understanding is that the server will send a cert to the client and the client will try and match in the local store in order to build the ssl connection...  Any help would be greatly appreciated...  Thanks in advance..

    000000E3 10:36:27.534894   32568.3     Constructing IBM.WMQ.Nmqi.NmqiStructureFormatter#01E9FF3E MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/NmqiStructureFormatter.cs
    000000E4 10:36:27.534894   32568.3     Object ID      : 'IBM.WMQ.MQChannelDefinition#02D0D2D6'
    000000E5 10:36:27.534894   32568.3     channelName    : 'XXX.MQ.CLIENT'
    000000E6 10:36:27.534894   32568.3     version        : 11 (hex B)
    000000E7 10:36:27.534894   32568.3     channelType    : 6 (hex 6)
    000000E8 10:36:27.534894   32568.3     transportType  : 2 (hex 2)
    000000E9 10:36:27.534894   32568.3     desc           : 0
    000000EA 10:36:27.534894   32568.3     qMgrName       : 0
    000000EB 10:36:27.534894   32568.3     connectionName : '192.168.168.62(2414)'
    000000EC 10:36:27.534894   32568.3     maxMsgLength   : 104857600 (hex 6400000)
    000000ED 10:36:27.534894   32568.3     userIdentifier : 0
    000000EE 10:36:27.534894   32568.3     password       : 'length:0'
    000000EF 10:36:27.534894   32568.3     heartbeatInterval: 1 (hex 1)
    000000F0 10:36:27.534894   32568.3     sslCipherSpec  : 'TLS_RSA_WITH_AES_128_CBC_SHA256'
    000000F1 10:36:27.534894   32568.3     sslPeerName    : ''
    000000F2 10:36:27.534894   32568.3     keepAliveInterval: -1 (hex FFFFFFFF)
    000000F3 10:36:27.534894   32568.3     localAddress   : ''
    000000F4 10:36:27.534894   32568.3     hdrCompList    : '0,0'
    000000F5 10:36:27.535891   32568.3     msgCompList    : '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0'
    000000F6 10:36:27.535891   32568.3     securityExit   : ''
    000000F7 10:36:27.535891   32568.3     securityUserData: ''
    000000F8 10:36:27.535891   32568.3     exitNameLength : 128 (hex 80)
    000000F9 10:36:27.535891   32568.3     exitDataLength : 32 (hex 20)
    000000FA 10:36:27.535891   32568.3     sendExitsDefined: 0 (hex 0)
    000000FB 10:36:27.535891   32568.3     sendExit       : ''
    000000FC 10:36:27.535891   32568.3     sendUserData   : ''
    000000FD 10:36:27.535891   32568.3     sendExitPtr    : [0]
    000000FE 10:36:27.535891   32568.3     sendUserDataPtr: [0]
    000000FF 10:36:27.535891   32568.3     receiveExitsDefined: 0 (hex 0)
    00000100 10:36:27.535891   32568.3     receiveExit    : ''
    00000101 10:36:27.535891   32568.3     receiveUserData: ''
    00000102 10:36:27.535891   32568.3     receiveExitPtr : [0]
    00000103 10:36:27.535891   32568.3     receiveUserDataPtr: [0]
    00000104 10:36:27.535891   32568.3     sharingConversations: 10 (hex A)
    00000105 10:36:27.535891   32568.3     clientChannelWeight: 0 (hex 0)
    00000106 10:36:27.535891   32568.3     connectionAffinity: 1 (hex 1)
    00000107 10:36:27.535891   32568.3    -----{  MQFAPConnectionPool.GetSession(MQConnectOptions,MQConnectionSecurityParameters,MQChannelDefinition,String,int,String,String,int,int) inputs  [64] [IBM.WMQ.MQConnectionSecurityParameters#03DE003D] [IBM.WMQ.MQChannelDefinition#02D0D2D6] [QMPNC] [0] [null] [null] [-1] [0] [null]
    00000108 10:36:27.536888   32568.3     Constructing IBM.WMQ.Nmqi.MQConnectionSpecification#0089F327 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/NmqiObject.cs
    00000109 10:36:27.536888   32568.3     Constructing IBM.WMQ.Nmqi.MQConnectionSpecification#0089F327 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/managed/MQConnectionSpecification.cs
    0000010A 10:36:27.536888   32568.3     Couldnt find a matching connection spec. Adding new one into table
    0000010B 10:36:27.537886   32568.3    ------{  MQConnectionSpecification.GetSession(MQConnectionSecurityParameters,MQFAP,String,MQConnectOptions,int) inputs  [IBM.WMQ.MQConnectionSecurityParameters#03DE003D] [IBM.WMQ.MQFAP#00538472] [QMPNC] [64] [0]
    0000010C 10:36:27.537886   32568.3    -------{  MQConnectionSpecification.EligibleForGeneralShareable(MQLONG) inputs  [64]
    0000010D 10:36:27.537886   32568.3    -------}  MQConnectionSpecification.EligibleForGeneralShareable(MQLONG) rc=OK returns [True]
    0000010E 10:36:27.538883   32568.3    -------{  MQConnectionSpecification.GetSessionFromEligibleConnection()
    0000010F 10:36:27.538883   32568.3    -------}  MQConnectionSpecification.GetSessionFromEligibleConnection() rc=OK
    00000110 10:36:27.538883   32568.3    -------{  MQConnectionSpecification.GetSessionFromEligibleConnection()
    00000111 10:36:27.538883   32568.3    -------}  MQConnectionSpecification.GetSessionFromEligibleConnection() rc=OK
    00000112 10:36:27.538883   32568.3    -------{  MQConnectionSpecification.GetSessionFromEligibleConnection()
    00000113 10:36:27.538883   32568.3    -------}  MQConnectionSpecification.GetSessionFromEligibleConnection() rc=OK
    00000114 10:36:27.538883   32568.3    -------{  MQConnectionSpecification.GetSessionFromNewConnection(MQConnectionSecurityParameters,MQFAP,String,MQConnectOptions,int) inputs  [IBM.WMQ.MQConnectionSecurityParameters#03DE003D] [IBM.WMQ.MQFAP#00538472] [QMPNC] [64] [0]
    00000115 10:36:27.539880   32568.3    --------{  MQConnectionSpecification.CreateAndConnectConnection(MQConnectionSecurityParameters,MQFAP,String,MQConnectOptions,int) inputs  [IBM.WMQ.MQConnectionSecurityParameters#03DE003D] [IBM.WMQ.MQFAP#00538472] [QMPNC] [64] [0]
    00000116 10:36:27.539880   32568.3    ---------{  MQConnectionSpecification.GetConnectOptions()
    00000117 10:36:27.539880   32568.3    ----------{  MQClientCfg.GetBoolValue(BoolCfgProperty)
    00000118 10:36:27.539880   32568.3    ----------}  MQClientCfg.GetBoolValue(BoolCfgProperty) rc=OK
    00000119 10:36:27.539880   32568.3    ----------{  MQClientCfg.GetBoolValue(BoolCfgProperty)
    0000011A 10:36:27.540878   32568.3    ----------}  MQClientCfg.GetBoolValue(BoolCfgProperty) rc=OK
    0000011B 10:36:27.540878   32568.3    ---------}  MQConnectionSpecification.GetConnectOptions() rc=OK
    0000011C 10:36:27.542873   32568.3    ---------{  MQChannelDefinition.Clone()
    0000011D 10:36:27.542873   32568.3     Constructing IBM.WMQ.MQChannelDefinition#012925A0 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/MQChannelDefinition.cs
    0000011E 10:36:27.542873   32568.3    ----------{  MQChannelDefinition.setDefaultDefinition()
    0000011F 10:36:27.542873   32568.3    ----------}  MQChannelDefinition.setDefaultDefinition() rc=OK
    00000120 10:36:27.543870   32568.3     Added header compression MQCOMPRESS_NONE
    00000121 10:36:27.543870   32568.3     Added header compression MQCOMPRESS_NONE
    00000122 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000123 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000124 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000125 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000126 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000127 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000128 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000129 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    0000012A 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    0000012B 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    0000012C 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    0000012D 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    0000012E 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    0000012F 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000130 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000131 10:36:27.543870   32568.3     Added message compression MQCOMPRESS_NONE
    00000132 10:36:27.546863   32568.3    ---------}  MQChannelDefinition.Clone() rc=OK returns [IBM.WMQ.MQChannelDefinition#012925A0]
    00000133 10:36:27.547858   32568.3     Constructing IBM.WMQ.MQTCPConnection#03BB7FAE MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/NmqiObject.cs
    00000134 10:36:27.547858   32568.3     Constructing IBM.WMQ.MQTCPConnection#03BB7FAE MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/managed/MQFAPConnection.cs
    00000135 10:36:27.547858   32568.3    ---------{  MQClientCfg.GetIntValue(IntCfgProperty) inputs  [IBM.WMQ.MQClientCfg+IntCfgProperty]
    00000136 10:36:27.547858   32568.3    ---------}  MQClientCfg.GetIntValue(IntCfgProperty) rc=OK
    00000137 10:36:27.548855   32568.3     Cfg value for the PASSWORD_PROTECTION: COMPATIBLE
    00000138 10:36:27.548855   32568.3     Setting PP option to default - NULL, this is compatible mode.
    00000139 10:36:27.548855   32568.3     Constructing IBM.WMQ.MQTCPConnection#03BB7FAE MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/MQTCPConnection.cs
    0000013A 10:36:27.548855   32568.3    ---------{  MQChannelDefinition.Clone()
    0000013B 10:36:27.548855   32568.3     Constructing IBM.WMQ.MQChannelDefinition#03737A94 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/MQChannelDefinition.cs
    0000013C 10:36:27.548855   32568.3    ----------{  MQChannelDefinition.setDefaultDefinition()
    0000013D 10:36:27.548855   32568.3    ----------}  MQChannelDefinition.setDefaultDefinition() rc=OK
    0000013E 10:36:27.548855   32568.3     Added header compression MQCOMPRESS_NONE
    0000013F 10:36:27.548855   32568.3     Added header compression MQCOMPRESS_NONE
    00000140 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000141 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000142 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000143 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000144 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000145 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000146 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000147 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000148 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000149 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    0000014A 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    0000014B 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    0000014C 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    0000014D 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    0000014E 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    0000014F 10:36:27.548855   32568.3     Added message compression MQCOMPRESS_NONE
    00000150 10:36:27.548855   32568.3    ---------}  MQChannelDefinition.Clone() rc=OK returns [IBM.WMQ.MQChannelDefinition#03737A94]
    00000151 10:36:27.548855   32568.3    ---------{  MQFAPConnection.InitSecurityExits()1
    00000152 10:36:27.548855   32568.3     Constructing IBM.WMQ.MQChannelExitHandler#02AB23D6 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/MQChannelExitHandler.cs
    00000153 10:36:27.549855   32568.3    ----------{  MQChannelExitHandler.LoadExits(MQLONG) inputs  [11]
    00000154 10:36:27.549855   32568.3    ----------}  MQChannelExitHandler.LoadExits(MQLONG) rc=OK
    00000155 10:36:27.550853   32568.3    ----------{  MQChannelExitHandler.InitializeExits(MQLONG,Boolean) inputs  [11] [True]
    00000156 10:36:27.550853   32568.3    ----------}  MQChannelExitHandler.InitializeExits(MQLONG,Boolean) rc=OK
    00000157 10:36:27.550853   32568.3    ---------}  MQFAPConnection.InitSecurityExits()1 rc=OK
    00000158 10:36:27.551850   32568.3    ---------{  MQFAPConnection.Connect(MQConnectionSecurityParameters) inputs  [IBM.WMQ.MQConnectionSecurityParameters#03DE003D]
    00000159 10:36:27.553845   32568.3    ----------{  MQTCPConnection.ConnectSocket(string,string,MQLONG) inputs  [] [192.168.168.62(2414)] [64]
    0000015A 10:36:27.553845   32568.3    -----------{  MQTCPConnection.ParseLocalAddress(String) inputs  []
    0000015B 10:36:27.553845   32568.3    ------------{  MQClientCfg.GetIntValue(IntCfgProperty) inputs  [IBM.WMQ.MQClientCfg+IntCfgProperty]
    0000015C 10:36:27.553845   32568.3    ------------}  MQClientCfg.GetIntValue(IntCfgProperty) rc=OK
    0000015D 10:36:27.553845   32568.3    ------------{  MQClientCfg.GetIntValue(IntCfgProperty) inputs  [IBM.WMQ.MQClientCfg+IntCfgProperty]
    0000015E 10:36:27.553845   32568.3    ------------}  MQClientCfg.GetIntValue(IntCfgProperty) rc=OK
    0000015F 10:36:27.553845   32568.3    ------------{  MQClientCfg.GetStringValue(StringCfgProperty) inputs  [IBM.WMQ.MQClientCfg+StringCfgProperty]
    00000160 10:36:27.553845   32568.3    ------------}  MQClientCfg.GetStringValue(StringCfgProperty) rc=OK
    00000161 10:36:27.553845   32568.3    -----------}  MQTCPConnection.ParseLocalAddress(String) rc=OK returns [IBM.WMQ.MQTCPConnection+ParsedLocalAddr]
    00000162 10:36:27.557834   32568.3    -----------{  MQClientCfg.GetStringValue(StringCfgProperty) inputs  [IBM.WMQ.MQClientCfg+StringCfgProperty]
    00000163 10:36:27.557834   32568.3    -----------}  MQClientCfg.GetStringValue(StringCfgProperty) rc=OK
    00000164 10:36:27.559827   32568.3    -----------{  MQTCPConnection.ConnectUsingLocalAddr(ParsedLocalAddr,IPAddress,int) inputs  [IBM.WMQ.MQTCPConnection+ParsedLocalAddr] [192.168.168.62] [2414]
    00000165 10:36:27.559827   32568.3     Remote Address:192.168.168.62:2414
    00000166 10:36:27.559827   32568.3     Local Address:0.0.0.0:0
    00000167 10:36:27.559827   32568.3     Bind using socket HDL:1820
    00000168 10:36:27.559827   32568.3     Bind returned 0.0.0.0:61009
    00000169 10:36:27.559827   32568.3     Connect
    0000016A 10:36:27.560825   32568.3     Connect returned True
    0000016B 10:36:27.561823   32568.3     TCP/IP LINGER disabled
    0000016C 10:36:27.561823   32568.3     Using socket send buffer size 32768
    0000016D 10:36:27.561823   32568.3     Using socket receive buffer size 32768
    0000016E 10:36:27.561823   32568.3    -----------}  MQTCPConnection.ConnectUsingLocalAddr(ParsedLocalAddr,IPAddress,int) rc=OK
    0000016F 10:36:27.561823   32568.3     IP:192.168.168.62
    00000170 10:36:27.562820   32568.3     Constructing IBM.WMQ.Nmqi.MQEncryptedSocket#015D6138 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/NmqiObject.cs
    00000171 10:36:27.562820   32568.3     Constructing IBM.WMQ.Nmqi.MQEncryptedSocket#015D6138 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/MQEncryptedSocket.cs
    00000172 10:36:27.565811   32568.3    -----------{  MQEncryptedSocket.RetrieveAndValidateSSLParams(MQConnectOptions)
    00000173 10:36:27.565811   32568.3     KeyStore is *SYSTEM
    00000174 10:36:27.565811   32568.3     KeyResetCount is 0
    00000175 10:36:27.565811   32568.3     CertificationCheck = False
    00000176 10:36:27.565811   32568.3     Hostname is :192.168.168.62
    00000177 10:36:27.565811   32568.3     CipherSpec value is TLS_RSA_WITH_AES_128_CBC_SHA256
    00000178 10:36:27.565811   32568.3     SSLPEERNAME value is 
    00000179 10:36:27.565811   32568.3    -----------}  MQEncryptedSocket.RetrieveAndValidateSSLParams(MQConnectOptions) rc=OK
    0000017A 10:36:27.572792   32568.3    -----------{  MQEncryptedSocket.MakeSecuredConnection()
    0000017B 10:36:27.572792   32568.3     Created an instance of SSLStreams
    0000017C 10:36:27.572792   32568.3     Setting current certificate store as 'Computer'
    0000017D 10:36:27.572792   32568.3     Created store object to access certificates
    0000017E 10:36:27.579774   32568.3     Opened store
    0000017F 10:36:27.579774   32568.3     Accessing certificate - ibmwebspheremqbluno
    00000180 10:36:27.580771   32568.3     TLS12 supported - True
    00000181 10:36:27.580771   32568.3     TLS13 supported - True
    00000182 10:36:27.580771   32568.3     Cipherspec protocol version:TLS 1.2
    00000183 10:36:27.581768   32568.3     Setting SslProtol as Tls12
    00000184 10:36:27.581768   32568.3     Starting SSL Authentication
    00000185 10:36:27.582766   32568.3     Server name is set to xxx2e-mq2e-client.chl.mq.ibm.com
    00000186 10:36:27.597726   32568.3    ------------{  MQEncryptedSocket.FixClientCertificate(Object,String,X509CertificateCollection,X509Certificate,String[])
    00000187 10:36:27.597726   32568.3     Client callback has been invoked to find client certificate
    00000188 10:36:27.597726   32568.3    ------------}  MQEncryptedSocket.FixClientCertificate(Object,String,X509CertificateCollection,X509Certificate,String[]) rc=OK
    00000189 10:36:36.931958   32568.3     System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
       at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
       at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
       at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
       at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest, Boolean renegotiation)
       at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest, Boolean renegotiation)
       at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
       at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
       at IBM.WMQ.Nmqi.MQEncryptedSocket.MakeSecuredConnection()
    0000018A 10:36:36.931958   32568.3    -----------}  MQEncryptedSocket.MakeSecuredConnection() rc=OK
    0000018B 10:36:36.932901   32568.3     System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
       at IBM.WMQ.Nmqi.MQEncryptedSocket.MakeSecuredConnection()
       at IBM.WMQ.Nmqi.MQEncryptedSocket..ctor(NmqiEnvironment env, MQTCPConnection conn, Socket socket, MQChannelDefinition mqcd, MQSSLConfigOptions sslConfigOptions)
       at IBM.WMQ.MQTCPConnection.ConnectSocket(String localAddr, String connectionName, Int32 options)
    0000018C 10:36:36.933954   32568.3     New MQException CompCode: 2 Reason: 2538
    0000018D 10:36:36.937943   32568.3    -----------{  ManagedCommonServices.GetMessage(string objectId,uint returncode,uint control,out string basicmessage,out string extendedmessage,out string replymessage,MQLONG basicLength,MQLONG extendedLength,MQLONG replyLength)
    0000018E 10:36:36.937943   32568.3     Returncode: 0x20009202 Control: 0x00000006
    0000018F 10:36:36.939938   32568.3     Accessing named resources 'amqmdnet.amqmdxcs' for culture 'en-US'
    00000190 10:36:36.947915   32568.3    -----------}  ManagedCommonServices.GetMessage(string objectId,uint returncode,uint control,out string basicmessage,out string extendedmessage,out string replymessage,MQLONG basicLength,MQLONG extendedLength,MQLONG replyLength) rc=OK
    00000191 10:36:36.955839   32568.3    -----------{  ManagedCommonServices.DisplayMessage(string,string,uint,uint)
    00000192 10:36:36.963875   32568.3    ------------{  ManagedCommonServices.GetMessage(string objectId,uint returncode,uint control,out string basicmessage,out string extendedmessage,out string replymessage,MQLONG basicLength,MQLONG extendedLength,MQLONG replyLength)
    00000193 10:36:36.963875   32568.3     Returncode: 0x20009202 Control: 0x00000013
    00000194 10:36:36.963875   32568.3    ------------}  ManagedCommonServices.GetMessage(string objectId,uint returncode,uint control,out string basicmessage,out string extendedmessage,out string replymessage,MQLONG basicLength,MQLONG extendedLength,MQLONG replyLength) rc=OK
    00000195 10:36:36.967808   32568.3     System.Security.SecurityException: The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security.
       at System.Diagnostics.EventLog.FindSourceRegistration(String source, String machineName, Boolean readOnly, Boolean wantToCreate)
       at System.Diagnostics.EventLog.SourceExists(String source, String machineName, Boolean wantToCreate)
       at System.Diagnostics.EventLog.SourceExists(String source)
       at IBM.WMQ.ManagedCommonServices.DisplayMessage(String objectId, String qmgrName, UInt32 returncode, UInt32 mtype)
    The Zone of the assembly that failed was:
    MyComputer
    00000196 10:36:36.967808   32568.3    ------------{  ManagedCommonServices.GetMessage(string objectId,uint returncode,uint control,out string basicmessage,out string extendedmessage,out string replymessage,MQLONG basicLength,MQLONG extendedLength,MQLONG replyLength)
    00000197 10:36:36.967808   32568.3     Returncode: 0x20009202 Control: 0x0000001A
    00000198 10:36:36.967808   32568.3    ------------}  ManagedCommonServices.GetMessage(string objectId,uint returncode,uint control,out string basicmessage,out string extendedmessage,out string replymessage,MQLONG basicLength,MQLONG extendedLength,MQLONG replyLength) rc=OK
    00000199 10:36:36.971852   32568.3    ------------{  ManagedCommonServices.OpenLogFile(String,String,FileMode,ref FileStream,Boolean,ref Boolean)
    0000019A 10:36:36.972854   32568.3     logLastCreationTimeUtc : '2/15/2024 3:36:36 PM', logLastLength : 0
    0000019B 10:36:36.974871   32568.3    -------------{  ManagedCommonServices.FileAddACE(String,String,MQULONG,MQULONG,MQULONG)
    0000019C 10:36:36.974871   32568.3     FilePath : 'R:\MQERRORLOGPATH/AMQERR01.LOG'
    0000019D 10:36:37.031636   32568.3     System.Management.ManagementException: Not found 
       at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
       at System.Management.ManagementObject.InvokeMethod(String methodName, ManagementBaseObject inParameters, InvokeMethodOptions options)
       at IBM.WMQ.ManagedCommonServices.FileAddACE(String filePath, String trusteeName, UInt32 accessMask, UInt32 accessFlags, UInt32 accessType)
    0000019E 10:36:37.031636   32568.3    -------------}! ManagedCommonServices.FileAddACE(String,String,MQULONG,MQULONG,MQULONG) rc=(Unknown(536895769))



    ------------------------------
    RICHARD RASMUSSEN
    ------------------------------



  • 4.  RE: Mq client / .net framework / key repository

    Posted Thu February 15, 2024 02:27 PM
      |   view attached

    I tried earlier today to reply to this but have not seen it become available...  I am trying again with a smaller trace snippet..

    I have tracing finally working and have narrowed my problem to either a cert issue or a qmgr config problem..   I would like to keep the ssl stuff simple with only the server sending a cert and the client verifying.  If I can avoid a client cert going to svr that would be great...  The trace has more info than I had before just not sure where to start..  Setup:  Client = my Dev workstation - Win11 | Server: Windows Svr 2022 - with the IBM MQ dev version installed.  Just want to do some basic dev testing putting and getting msg's thru a ssl connection and understanding the process better..

    00000171 10:36:27.562820   32568.3     Constructing IBM.WMQ.Nmqi.MQEncryptedSocket#015D6138 MQMBID sn=p934-L231004.DE su=_D0rCUGK-Ee6-0-1cOGl6kg pn=basedotnet/nmqi/MQEncryptedSocket.cs
    00000172 10:36:27.565811   32568.3    -----------{  MQEncryptedSocket.RetrieveAndValidateSSLParams(MQConnectOptions)
    00000173 10:36:27.565811   32568.3     KeyStore is *SYSTEM
    00000174 10:36:27.565811   32568.3     KeyResetCount is 0
    00000175 10:36:27.565811   32568.3     CertificationCheck = False
    00000176 10:36:27.565811   32568.3     Hostname is :192.168.168.62
    00000177 10:36:27.565811   32568.3     CipherSpec value is TLS_RSA_WITH_AES_128_CBC_SHA256
    00000178 10:36:27.565811   32568.3     SSLPEERNAME value is 
    00000179 10:36:27.565811   32568.3    -----------}  MQEncryptedSocket.RetrieveAndValidateSSLParams(MQConnectOptions) rc=OK
    0000017A 10:36:27.572792   32568.3    -----------{  MQEncryptedSocket.MakeSecuredConnection()
    0000017B 10:36:27.572792   32568.3     Created an instance of SSLStreams
    0000017C 10:36:27.572792   32568.3     Setting current certificate store as 'Computer'
    0000017D 10:36:27.572792   32568.3     Created store object to access certificates
    0000017E 10:36:27.579774   32568.3     Opened store
    0000017F 10:36:27.579774   32568.3     Accessing certificate - ibmwebspheremqbluno
    00000180 10:36:27.580771   32568.3     TLS12 supported - True
    00000181 10:36:27.580771   32568.3     TLS13 supported - True
    00000182 10:36:27.580771   32568.3     Cipherspec protocol version:TLS 1.2
    00000183 10:36:27.581768   32568.3     Setting SslProtol as Tls12
    00000184 10:36:27.581768   32568.3     Starting SSL Authentication
    00000185 10:36:27.582766   32568.3     Server name is set to xxx2e-mq2e-client.chl.mq.ibm.com
    00000186 10:36:27.597726   32568.3    ------------{  MQEncryptedSocket.FixClientCertificate(Object,String,X509CertificateCollection,X509Certificate,String[])
    00000187 10:36:27.597726   32568.3     Client callback has been invoked to find client certificate
    00000188 10:36:27.597726   32568.3    ------------}  MQEncryptedSocket.FixClientCertificate(Object,String,X509CertificateCollection,X509Certificate,String[]) rc=OK
    00000189 10:36:36.931958   32568.3     System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
       at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
       at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
       at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
       at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest, Boolean renegotiation)
       at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest, Boolean renegotiation)
       at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
       at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
       at IBM.WMQ.Nmqi.MQEncryptedSocket.MakeSecuredConnection()
    0000018A 10:36:36.931958   32568.3    -----------}  MQEncryptedSocket.MakeSecuredConnection() rc=OK
    0000018B 10:36:36.932901   32568.3     System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
       at IBM.WMQ.Nmqi.MQEncryptedSocket.MakeSecuredConnection()

    Thanks in advance!

    Richard R.



    ------------------------------
    Richard Rasmussen Mgr. Software Development
    ------------------------------

    Attachment(s)

    txt
    AMQ32568.txt   50 KB 1 version