java - 尝试通过 java 客户端访问 MQ 7.5 服务器但出现错误，已创建 SYSTEM.SSL.SVRCONN

Question

没有 SSL，我可以连接，但使用 SSL，它会在 MQ 日志中抛出以下错误

AMQ9660: SSL key repository: password stash file absent or unusable.

EXPLANATION:
The SSL key repository cannot be used because MQ cannot obtain a password to
access it. Reasons giving rise to this error include: 
(a) the key database file and password stash file are not present in the
  location configured for the key repository, 
(b) the key database file exists in the correct place but that no password
  stash file has been created for it, 
(c) the files are present in the correct place but the userid under which MQ is
  running does not have permission to read them, 
(d) one or both of the files are corrupt. 

The channel is '????'; in some cases its name cannot be determined and so is
shown as '????'. The channel did not start.
ACTION:
Ensure that the key repository variable is set to where the key database file
is. Ensure that a password stash file has been associated with the key database
file in the same directory, and that the userid under which MQ is running has
read access to both files. If both are already present and readable in the
correct place, delete and recreate them. Restart the channel. 
----- amqccisa.c : 5577 -------------------------------------------------------
6/30/2015 12:15:33 - Process(14120.5) User(locahost) Program(amqrmppa.exe)
                      Host(localhost) Installation(Installation1)
                      VRMF(7.5.0.2) QMgr(QM1)

AMQ9492: The TCP/IP responder program encountered an error.

这是产生错误的代码:

import javax.jms.JMSException;
import javax.jms.Session;

import com.ibm.mq.*;
import com.ibm.jms.JMSMessage;
import com.ibm.jms.JMSTextMessage;
import com.ibm.mq.jms.JMSC;
import com.ibm.mq.jms.MQQueue;
import com.ibm.mq.jms.MQQueueConnection;
import com.ibm.mq.jms.MQQueueConnectionFactory;
import com.ibm.mq.jms.MQQueueReceiver;
import com.ibm.mq.jms.MQQueueSender;
import com.ibm.mq.jms.MQQueueSession;

import java.io.*;

import javax.net.ssl.*;

import java.net.ServerSocket;
import java.net.Socket;
import java.security.KeyStore;
/**
 * simple testcase for Point-to-point messaging .
 */
public class MQTEST {
  /**
   * Main method
   *
   * @param args
   */
  public static void main(String[] args) {
    try {
        SSLContext context = SSLContext.getDefault();
        System.setProperty("javax.net.ssl.trustStore","D:\\IBM\\CERT\\truststore.jks");
         System.setProperty("javax.net.ssl.keyStore","D:\\IBM\\Websphere\\Qmgrs\\QM1\\ssl\\key.kdb");
       System.setProperty("javax.net.ssl.keyStorePassword","password");





      MQQueueConnectionFactory cf = new MQQueueConnectionFactory();

      // Config
      cf.setHostName("localhost");
      cf.setPort(1414);
      cf.setTransportType(JMSC.MQJMS_TP_CLIENT_MQ_TCPIP);
      cf.setQueueManager("QM1");
     cf.setChannel("SYSTEM.SSL.SVRCONN");
    // cf.setChannel("SYSTEM.DEF.SVRCONN");

     cf.setSSLCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA");



      MQQueueConnection connection = (MQQueueConnection) cf.createQueueConnection();


      MQQueueSession session = (MQQueueSession) connection.createQueueSession(false, Session.CLIENT_ACKNOWLEDGE);
      MQQueue queue = (MQQueue) session.createQueue("queue:///LQ1");
      MQQueueSender sender =  (MQQueueSender) session.createSender(queue);

Answer 1

问题的错误日志格式和措辞表明是队列管理器无法访问其 KDB keystore 。

(注意:提供错误日志时，如果您是从 QMgr 或客户端获取的，请告知我们!“MQ 日志”可以是任何一种方式。)

考虑到这一点，您应该运行配置队列管理器证书的设置过程。这包括:

1. 生成一个指定“隐藏密码”选项的空 KDB 文件
2. 生成自签名证书或证书签名请求 (CSR)

如果这是一个 CA 签名的证书...

1. 签署 CSR
2. 将证书颁发机构的签署者证书导入 QMgr 的 KDB 和客户端 keystore
3. 将签名的 CSR 接收到 keystore 中

如果这是自签名证书...

1. 提取自签名证书的公共(public)部分
2. 将自签名证书导入客户端的 keystore

如果您省略了这些步骤中的任何一个，请从上次停下的地方继续。

如果您忘记存储密码或存储文件已损坏，请使用 iKeyman GUI 或 runmqakm 命令的适当选项重新创建它。

请注意，如果 KDB 完全不存在，QMgr 仍会抛出上述错误。这是因为它做的第一件事就是尝试打开隐藏文件。如果找不到它，则会抛出 password stash file absent or unusable 错误。即使从未创建过 KDB，也是如此。