Question

I use a Java client using JMS/JNDI. The connection is working when using one-way SSL authentication SSLCAUTH(OPTIONAL). The first step I did is to export the public certificate of the client:

keytool -export -keystore keystore -storepass storepass -alias CLIENT -file client.cer

Then I added this certificate to the MQ key repository.

gsk7cmd -cert -add -db keydb.kdb -pw password -label ibmwebspheremqclient -file client.cer -format binary

And I finally switched to SSLCAUTH(REQUIRED) mode.

I get the following error log. The message is pretty clear, it can’t find my client certificate. I read that my client certificate should have a label ibmwebspheremq<client_user_id>. What is this user id since I am connecting via Java?

AMQ9637: Channel is lacking a certificate.

Answer 1

As per the Technote Specifying the userid in the SSL certificate label for an MQ client the Java and JMS clients do not find their certificate based on the label.

What is often the problem is a mis-match between the trust store and the key store. I have seen two problems fairly commonly.

1. The application specifies a trust store but not a keystore. This works great for anonymous (one-way) SSL but not for mutual authenticated SSL. The app must specify both key store and trust store for mutual auth.
2. Sometimes the app specifies a trust store file but the private certs are in the key store. Or the app specifies the same file for both trust store and the key store and the personal certs are actually in a separate trust store file.

Does either of these solve the problem? If not, please update the question with a keytool -cert -list for both the key store and the trust store and the part of the command line or code that sets up the keystore/truststore.