Home/ Questions/Q 8262129
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T03:39:45+00:00

I have a C# Web service which is running under IIS 7.5 on Windows

  • 0

I have a C# Web service which is running under IIS 7.5 on Windows Server 2008 R2 using the DefaultAppPool user as the application identity (IIS APPPOOL\DefaultAppPool). The Web service uses IBM Websphere MQ (7.0.1.2) to do it’s stuff and uses the SSL certificates stored in a key.kdb setup via IBMs KeyMan utility.

Normally (for C# apps that are not running IIS) I need to label the personal certificate within the kdb so that it’s name matches the user that is running the app i.e. the certificate would be labelled as ibmwebspheremqbs6mjb (see http://www-01.ibm.com/support/docview.wss?uid=swg21245474) and this allows the app to successfully access the SSL certificates within the key.kdb.

But….. when running as a Web service and naming the certificate ibmwebspheremqdefaultapppool the application cannot access the SSL certs. If I change the AppPool identity to be bs6mjb then everything works (I’m not allowed to run the app pool as bs6mjb).

I’d prefer not to setup a default certificate as mentioned in the link above, does anyone know what the certificate should be labelled as to work with DefaultAppPool?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    For MQ clients the certificate label must have the user name who runs the client. In your case, for example ibmwebspheremqbs6mjb. If the certificate label is something else, the MQ client (actually GSKit libraries) will not find the certificate to connect to queue manager. I think that’s what is happening when you have the label as ibmwebspheremqdefaultapppool.

    This blog has interesting and useful details. You may want to check under what user IIS runs and create a certificate for that user and do the required SSL setup between client and MQ queue manager.

    • 0