MQ

MQ

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Building a Certificate Expiry Report for MQ

    Posted Tue January 26, 2021 09:56 AM
    If you would have interest in how to build a certificate expiry report for your MQ client and queue manager certificates and also improve your TLS authentication, you may find the following blog post helpful.

    https://community.ibm.com/community/user/middleware/blogs/tim-zielke1/2020/04/25/using-serialnumber-with-tls-authentication-in-ibm

    ------------------------------
    Tim Zielke
    ------------------------------


  • 2.  RE: Building a Certificate Expiry Report for MQ

    Posted Thu January 28, 2021 05:08 PM
    This is good info. I have been looking into how to monitor our AMS certificates expiration dates so that admins can get notified 90/60/30 days in advanced. Would it be similar to this? Do you have any information regarding monitoring certs for AMS?

    ------------------------------
    Gwen Buzynski
    ------------------------------

    Original Message


  • 3.  RE: Building a Certificate Expiry Report for MQ

    Posted Thu January 28, 2021 05:52 PM
    Hi Gwen,

    I am not familiar with what AMS is, but assuming we are talking about a Certificate Authority then yes this would work. The basic idea here is only use sslpeer channel authentication rules that validate both the serialnumber and issuer of a certificate. Once you do this, you are now only validating for unique certificates. Since your sslpeer channel authentication rules now each represent a unique certificate, you can document the expiration date for that certificate in the description of the channel authentication rule. Now you have a source of truth for all the certificates that you allow to authenticate in your MQ environment (i.e. queue manager, client, business partner, etc.) and you can build a report from your sslpeer channel authentication rules for when they expire.

    Thanks,
    Tim

    ------------------------------
    Tim Zielke
    ------------------------------

    Original Message


  • 4.  RE: Building a Certificate Expiry Report for MQ

    Posted Fri January 29, 2021 03:31 AM
    If we're talking about Advanced Messaging Security i.e. at rest encryption, Tim's way won't work because there is no chlauth entry for those.
    You will need to use the old way or looking for the cert store and running either runmqakm or runmqckm with the cert details and doing a grep on the labels then the expiry...

    ------------------------------
    Francois Brandelik
    ------------------------------

    Original Message


  • 5.  RE: Building a Certificate Expiry Report for MQ

    Posted Mon February 01, 2021 11:51 AM
    I figured so, thank you. Does anyone have a good script that they are currently utilizing that will retrieve information from AMS MQ keystore and grep for cert expiring dates?

    ------------------------------
    Gwen Buzynski
    ------------------------------

    Original Message


  • 6.  RE: Building a Certificate Expiry Report for MQ

    Posted Fri January 29, 2021 04:06 AM

    Unfortunately the SET POLICY command does not provide a DESCRiption field in the same way as the SET CHLAUTH command does, so there is nowhere to store the expiry date against each AMS policy. Suggest you raise an RFE for this. There was a recently raised RFE asking for a DESCRiption on DEFINE SUB, so might be worth adding a comment on that one too.

    Cheers,
    Morag



    ------------------------------
    Morag Hughson
    MQ Technical Education Specialist
    MQGem Software Limited
    Website: https://www.mqgem.com
    ------------------------------

    Original Message


  • 7.  RE: Building a Certificate Expiry Report for MQ

    Posted Tue February 02, 2021 04:23 AM
    Hi,

    For reference, the MQ Appliance includes a certificate monitor that can be configured to generate log events when certificates have expired, or are due to expire within a configurable number of days. Prior to MQ 9.2 the appliance certificate monitor only supports certificates used for system configuration, such as the web UI, but from the MQ 9.2 firmware the certificate monitor also logs alerts for certificates in queue manager key repositories.

    • [0x8060034b] Certificate 'mycert' for queue manager 'QM1' expired at '2020-03-31T15:40:08Z'
    • [0x8060034c] Certificate 'mycert' for queue manager 'QM1' is about to expire at '2020-03-31T15:40:08Z'

    See https://www.ibm.com/support/knowledgecenter/SS5K6E_9.2.0/com.ibm.mqa.doc/security/se00290_.htm

    When developing your own scripts you might find the runmqakm -cert -list command (listcert on the appliance) useful, which has a -expiry [days] option that can be used to report similar information. If you set the timezone (e.g. TZ environment variable on Linux/UNIX) to UTC before running the command then this should also help you parse the expiry dates by avoiding daylight savings time adjustments.

    ------------------------------
    Jamie Squibb
    ------------------------------

    Original Message


Related Content