java - MQ 服务器失败 : AMQ9637: Channel is lacking a certificate. 但 Java 客户端配置为发送它

Question

我在客户端报告的 SSL 握手问题如下:

main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
...
    Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Remote host closed connection during handshake],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.startHandshake,5=default]
        at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1187)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:724)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:400)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:299)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:164)
        at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1598)
        ... 15 more
    Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:953)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1359)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1343)
        at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1156)
        at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1151)
        at java.security.AccessController.doPrivileged(Native Method)
        at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1149)
        ... 20 more
    Caused by: java.io.EOFException: SSL peer shut down incorrectly
        at sun.security.ssl.InputRecord.read(InputRecord.java:482)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:934)
        ... 27 more

在 MQ 服务器上:

AMQ9637: Channel is lacking a certificate.

很明显服务器没有获取(或接受？)客户端证书。这是错误的前提，问题是服务器证书。

我使用:

JAVA 7 (1.7.0_75) 
MQ 7.5 client libs (7.5.0.2)
MQ 8.0 server (8.0.0.5)

这里是 client Java class .我尝试接受所有服务器证书，并将客户端证书发送到 MQ 服务器端，并在 MQ 信任库中导入相同的证书。不确定问题是否是对证书名称的任何限制，如此处所示:http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg21245474或者如果证书真的没有发送到服务器端。

---编辑:---

这是我的 QMGR 和 CNL 配置的 SSL 屏幕:

Answer 1

首先，我使用自己的标签创建证书，但不同于默认生成的证书:

MQMGR->Properties->SSL->Certificate Label

这是ibmwebspheremq<qmgr_name_lower_case> ，当我重新创建具有指定名称的证书时:

runmqakm -cert -create -label ibmwebspheremqqm_qmname -stashed -dn "CN=corp.com,OU=DEV,OU=QMGR,O=CORP,L=member,ST=NC,C=US,EMAIL=name.surname@corp.com" -fips -db key.kdb -ca false

它开始与服务器通信。

编辑:另见this .