Refreshing the queue manager's key repository

When you change the contents of a key repository, existing queue manager processes do not pick up the new contents until a REFRESH SECURITY TYPE(SSL) command is issued or the queue manager is restarted.

For more information about the REFRESH SECURITY TYPE(SSL) command, see REFRESH SECURITY.

If the queue manager creates a new channel process (using amqrmppa or runmqchl) after changing the contents of the keystore, the new process starts using the new certificates immediately, while existing processes continue to use their cached copy of the keystore. See When changes to certificates or the certificate store become effective on AIX, Linux, and Windows for more details.

Note, that multiple running channels could be using different versions of the key repository until you issue a REFRESH SECURITY TYPE(SSL) command.

You can also refresh a key repository using PCF commands or the IBM® MQ Explorer. For more information, see the MQCMD_REFRESH_SECURITY command and the topic Refreshing TLS Security in the IBM MQ Explorer section of this product documentation.