在Websphere App Server和Websphere MQ之间配置SSL
我尝试从WebSphere应用服务器上启动的简单Web服务连接到WMQ。在Websphere App Server和Websphere MQ之间配置SSL
在WMQ上,我有SSL通道。我现在使用自签名证书。
在glassfish的情况下,我只是将此证书添加到域中的密钥存储区,并且所有工作都很好(因为我配置了我的MQQueueConnectionFactory)。
但在WebSphere这招不起作用:
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O %% Invalidated: [Session-94, SSL_RSA_EXPORT_WITH_RC4_40_MD5]
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O jmsContainer-1, SEND SSLv3 ALERT: fatal, description = certificate_unknown
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O jmsContainer-1, WRITE: SSLv3 Alert, length = 2
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O [Raw write]: length = 7
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O 0000: 15 03 00 00 02 02 2e .......
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O jmsContainer-1, called closeSocket()
[5/13/13 14:00:25:058 FET] 00000060 SystemOut O jmsContainer-1, handling exception: javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: PKIX path building failed: java.security.cert.CertPathBuilderException: unable to find valid certification path to requested target
[5/13/13 14:00:25:058 FET] 00000060 DefaultMessag E org.springframework.jms.listener.DefaultMessageListenerContainer refreshConnectionUntilSuccessful Could not refresh JMS Connection for destination 'fromESB' - retrying in 5000 ms. Cause: JMSWMQ0018: Failed to connect to queue manager 'qm1' with connection mode 'Client' and host name '192.168.56.101(1414)'.; nested exception is com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2397' ('MQRC_JSSE_ERROR').
如何配置WebSphere应用服务器使用SSL(如何添加服务器(WMQ)证书信任存储或者是信任存储? ?)?
好的。我自己解决这个问题。
配置WMQ:
-
创建密钥库
runmqckm -keydb -create -db “C:\ dev的\ sslqm001 \ sslqm001.kdb” -pw serverpass型CMS -expire 365 -stash
-
创建证书,并把它添加到密钥存储
runmqckm -cer t -create -db“c:\ dev \ sslqm001 \ sslqm001.kdb”-pw serverpass -label ibmwebspheremqssl_qm001 -dn“CN = SSL_QM001,OU = IT,O = SomeCompany,L =明斯克,ST =白俄罗斯,C = BY“-expire 365
-
将此证书从密钥库导出到文件。
runmqckm -cert -extract -db “C:\ dev的\ sslqm001 \ sslqm001.kdb” -pw serverpass -label ibmwebspheremqssl_qm001 -target SSL_QM001.crt -format ASCII
-
在队列管理器设置,选项卡“ SSL“设置到密钥库的路径,而不需要。KDB和FIPS为否:
ALTER QMGR SSLKEYR( 'C:\ dev的\ sslqm001 \ sslqm001') ALTER QMGR SSLFIPS(NO)
创建新信道
-
在信道设置,标签 “SSL” 设置密码为某个值(与我的作品:DES_SHA_EXPORT),并权威性与可选
DEFINE CHANNEL( 'SSL_CHANNEL')CHLTYPE(SVRCONN)TRPTYPE(TCP)SSLCIPH(DES_SHA_EXPORT)SSLCAUTH(可选)REPLACE
-
在队列管理器刷新SSL:
REFRESH SECURITY TYPE(SSL)
改变你appcontex:
<bean id="mqConnectionFactory" class="com.ibm.mq.jms.MQQueueConnectionFactory">
<property name="hostName" value="${queue_hostname}"/>
<property name="port" value="${queue_port}"/>
<property name="queueManager" value="${queue_manager}"/>
<property name="transportType" value="1"/>
<property name="SSLCipherSuite" value="SSL_RSA_EXPORT_WITH_RC4_40_MD5"/>
<property name="channel" value="ssl_channel"/>
</bean>
设置SSL在WAS
-
转到:
安全性→SSL证书和密钥管理→SSL配置→ NodeDefaultSSLSettings→密钥库和证书→NameOfStore→ 签署者证书
添加您的证书,我们出口在第3步