SSL connection errors on some channels but not all...

[Andrew Hunt]

Hi Listers.

I am working on an upgrade from MQ6023 (Solaris) to MQ75. (Red Hat)

As part of the upgrade I am using the new machine to test the connections
which has SSL applied. However I am getting an unexplained AMQ9633 error
pasted below.

This is a Versign CA cert and and intermediate. I have checked that the
Authentication key serial number matches the serial in the root cert. I have;
- remove the certs and readded (in two orders)
- removed all extra certs and added only verisign
- rebuilt keystore from scratch

We are using OCSPAuthentication=OPTIONAL in the qm.ini. It doesn't seem to
be an LDAP problem as far as I can tell

We have used self signed (within the bank) for 6 years and conencting to
external company using Verisign.

There are othe connections which use the same chain that are working.

Has anyone got any hints or ideas? I'm stumped....

-------------
Error message
-------------
AMQ9633: Bad SSL certificate for channel '<channelname>'.

EXPLANATION:
A certificate encountered during SSL handshaking is regarded as bad for one of
the following reasons:
(a) it was formatted incorrectly and could not be validated
(b) it was formatted correctly but failed validation against the Certification
Authority (CA) root and other certificates held on the local system
(c) it was found in a Certification Revocation List (CRL) on an LDAP server
(d) a CRL was specified but the CRL could not be found on the LDAP server
(e) an OCSP responder has indicated that it is revoked

The channel is '<channelname>'; in some cases its name cannot be
determined and so is shown as '????'. The remote host is
'destinationhostname (destI)(1453)'. The channel did not start.

The details of the certificate which could not be validated are '????'.

The certificate validation error was 575010.
----------------------

Thanks in advance,
Andrew Hunt

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Tim Zielke]

Hi Andrew,

My recommendation would be to open a service request with IBM and provide them an MQ SSL trace. Based on my experience, IBM does not provide a way for an administrator to format the AMQ.SSL.TRC, like with a dspmqtrc command. I assume they are hiding those internals from the masses, since SSL/TLS internals need to be kept secretive for ostensible reasons.

Thanks,
Tim

-----Original Message-----
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Andrew Hunt
Sent: Friday, August 30, 2013 11:08 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: SSL connection errors on some channels but not all...

Hi Listers.

I am working on an upgrade from MQ6023 (Solaris) to MQ75. (Red Hat)

As part of the upgrade I am using the new machine to test the connections
which has SSL applied. However I am getting an unexplained AMQ9633 error
pasted below.

This is a Versign CA cert and and intermediate. I have checked that the
Authentication key serial number matches the serial in the root cert. I have;
- remove the certs and readded (in two orders)
- removed all extra certs and added only verisign
- rebuilt keystore from scratch

We are using OCSPAuthentication=OPTIONAL in the qm.ini. It doesn't seem to
be an LDAP problem as far as I can tell

We have used self signed (within the bank) for 6 years and conencting to
external company using Verisign.

There are othe connections which use the same chain that are working.

Has anyone got any hints or ideas? I'm stumped....

-------------
Error message
-------------
AMQ9633: Bad SSL certificate for channel '<channelname>'.

EXPLANATION:
A certificate encountered during SSL handshaking is regarded as bad for one of
the following reasons:
(a) it was formatted incorrectly and could not be validated
(b) it was formatted correctly but failed validation against the Certification
Authority (CA) root and other certificates held on the local system
(c) it was found in a Certification Revocation List (CRL) on an LDAP server
(d) a CRL was specified but the CRL could not be found on the LDAP server
(e) an OCSP responder has indicated that it is revoked

The channel is '<channelname>'; in some cases its name cannot be
determined and so is shown as '????'. The remote host is
'destinationhostname (destI)(1453)'. The channel did not start.

The details of the certificate which could not be validated are '????'.

The certificate validation error was 575010.
----------------------

Thanks in advance,
Andrew Hunt

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Andrew Hunt]

LMR - Thanks, I have taken a look at the chains and I have other channels
using the same intermediate certificate. The next thing I might look at is
whether it needs a second root, although this would not make sense to me.

@Tim - On Monday a call is going to be opened with IBM and my knowledge of
tracing will have to be tested...

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Andrew Hunt]

To follow up on this - we added back in all the Verisign certificates and the
connection worked.

It's an odd one, the other end gave a SSLCERTI value which we had in the
keystore - the Authentication Key referenced in that intermediate was present in
a root that we also had in the keystore. This leads me to believe that there is a
significant gap in my understanding.

How can one tell manually if the certificate chain is complete? I thought checking
AKI info was sufficient?

Any pointers qould be much appreciated.

hunty

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES

[Tim Zielke]

Hi Andrew,

For a given personal/user certificate X, I believe manually checking if the certificate chain is complete for that certificate would be making sure the "Issued By" field in X points to a signer certificate that is in the applicable SSL keystore. If that signer certificate that the Issued By field in X points to is an intermediary, then you need to follow its "Issued By" field and so on until you reach the root signer certificate (a signer certificate whose Issued By field matches the DN name on that certificate). Along the way, all the intermediary certificates need to be in the SSL keystore. So it is basically the Issued By field that you are traversing from the personal/user certificate -> intermediary signer certificates -> root signer certificate for the verification. That is at least how I understand it. I don't claim to be an expert.

This link from the MQ manual goes over it more -> http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/topic/com.ibm.mq.doc/sy10600_.htm?resultof=%22%63%65%72%74%69%66%69%63%61%74%65%22%20%22%63%65%72%74%69%66%22%20%22%63%68%61%69%6e%22%20

Thanks,
Tim

-----Original Message-----
From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Andrew Hunt
Sent: Monday, September 02, 2013 5:01 AM
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: Re: SSL connection errors on some channels but not all...

To follow up on this - we added back in all the Verisign certificates and the
connection worked.

It's an odd one, the other end gave a SSLCERTI value which we had in the
keystore - the Authentication Key referenced in that intermediate was present in
a root that we also had in the keystore. This leads me to believe that there is a
significant gap in my understanding.

How can one tell manually if the certificate chain is complete? I thought checking
AKI info was sufficient?

Any pointers qould be much appreciated.

hunty

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES