IBM Support

Using SSL TLS to connect an IBM MQ 9.3 queue manager in Windows with another one in Linux, using self-signed certificates

Question & Answer


Question

The objective of this document is to provide step-by-step details to:
- connect an MQ 9.3 queue manager in Windows
- to a single-instance queue manager running MQ 9.3 in Linux,
- using self-signed certificates (ok for Test queue managers, but not for Production, because no Certification Authority is involved, no root certificates).
- 2-way authentication (each queue manager authenticates the other queue manager).
- using the runmqckm (iKeycmd) from the command line, that is, not using the strmqikm (iKeyman) GUI.
.

Answer

The main scenario is to put a message in the remote queue definition in the Windows queue manager QMFINTLS and then the TLS enabled "sender" channel will transfer the message to the TLS enabled "receiver" channel in the Linux queue manager QMSTMTLS.
.
For illustration purposes the following protocol will be used:
TLS 1.3 compliant: TLS_AES_128_GCM_SHA256
+++ See attached PDF file:
+ tags:
"MQ SSL"; "MQ TLS"; MQSSL; MQTLS; Author: Angel Rivera
+++ end +++

[{"Type":"MASTER","Line of Business":{"code":"LOB67","label":"IT Automation \u0026 App Modernization"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"ARM Case Number":"TS015503736","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
15 March 2024

UID

ibm17121151

Page Feedback