How to perform common tasks for the management of IBM MQ certificates

Answer

• runmqakm -cert -list -db <keyfile.kdb> -pw <password> -expiry xx

runmqakm -cert -list -db key.kdb -pw password -expiry 90

Back to top

• runmqakm -cert -list -db <keyfile.kdb> -pw <password> 

Back to top

• runmqakm -cert -details -label <cert_label> -db <keyfile.kdb> -pw <password>

Back to top

• Create the queue manager keystore if none exists.
• Create the CSR, and and send it to the CA.
• Receive the CA signed personal certificate requested sent by the CA into the keystore
• Add CA Singer Certificates (Intermediates and Root) into the keystore. Note: This a mandatory step for certificate validation. For more details see the following technote:

Back to top

• runmqakm -cert -export -db <keyfile.kdb> -pw <password> -label <label> -type <cms> -target <filename> -target_pw <password> -target_type <kdb>

• runmqakm -cert -import -file <filename> -pw <password> -type <kdb> -target <filename> -target_pw <password> -target_type <cms> -label <labelName>

• runmqakm -cert -list -db <filename> -stashed

Back to top

• runmqakm -cert -list -db <keyfile.kdb> -pw <password>

runmqakm -cert -list -db key.kdb -stashed
Certificates found
* default, - personal, ! trusted, # secret key
!    ibmwebspheremqperez
-    ibmwebspheremqssl1

• runmqckm -cert- list personal -db <file.kdb> -pw <password>

• Open keystore file -> From the drop down menu select "Personal Certificates"

Back to top

• runmqakm -cert -details -label <cert_label> -db <filename> -stashed

Back to top

How to combine public certificate and private key into PKCS12 file

Sometimes you may have your public certificate and private key sent in one combined file or in two separate files. To import them into MQ they will need to be in one pkcs12 file. If your certificate and key come in separate files you can skip the Split Certificate/Key in Text Editor step.

Split Certificate/Key in Text Editor:

If your certificate and key are in separate files you can split them in a text editor into two files.

The certificate will have delimiters at the start and end of the certificate. Include these in your new certificate file.

Certificate Delimiter Example: -----BEGIN CERTIFICATE----- <CERTIFICATE> -----END CERTIFICATE-----

Name the cert exampleCert.crt for clarity.

The private key will also have delimiters surrounding the key. Include these in the new private key file.

Private Key Delimiter Example:  -----BEGIN PRIVATE KEY-----<PRIVATE KEY> -----END PRIVATE KEY-----

Name the cert exampleCert.key for clarity.

OpenSSL On Linux/AIX:

Using the "OpenSSL pkcs12 -export" command you can combine the certificate and the private key. The usage is:

openssl pkcs12 -export -out [OutputCertificate] -inkey [InputPrivateKey]-in [InputCertificate]

certutil on Windows:

certutil is a built in utility in Windows. It requires your certificate and private key have the same file names with different extensions. The command usage is:

certutil -mergepfx [InputCertificate] [OutputCertificate]

The private key's file name is inferred by the command. In our example pictured because our certificate is exampleCert.crt certutil will look for an exampleCert.key to merge.

Back to top