Connect a client to a queue manager securely

Secure communications that use the TLS cryptographic security protocols involve setting up the communication channels and managing the digital certificates that we will use for authentication.

To set up your SSL/TLS installation we must define your channels to use TLS. We must also obtain and manage your digital certificates. On a test system, we can use self-signed certificates or certificates issued by a local certificate authority (CA). On a production system, do not use self-signed certificates.

For full information about creating and managing certificates, see the following topics:

• Work with SSL or TLS on IBM i
• Work with SSL or TLS on UNIX, Linux, and Windows systems
• Work with SSL or TLS on z/OS

This collection of topics introduces the tasks involved in setting up SSL/TLS communications, and provides step-by-step guidance on completing those tasks.

We might also want to test SSL/TLS client authentication, which are an optional part of the protocols. During the SSL/TLS handshake, the SSL/TLS client always obtains and validates a digital certificate from the server. With the IBM MQ implementation, the SSL/TLS server always requests a certificate from the client.

On IBM i, UNIX, Linux, and Windows systems, the SSL/TLS client sends a certificate only if it has one labeled in the correct IBM MQ format, which is either ibmwebspheremq followed by your logon user ID in lowercase, or the value of the CERTLABL attribute. See Digital certificate labels.

The SSL/TLS server always validates the client certificate if one is sent. If the client does not send a certificate, authentication fails only if the end of the channel that is acting as the SSL/TLS server is defined with either the SSLCAUTH parameter set to REQUIRED or an SSLPEER parameter value set. For more information about connecting a queue manager anonymously, see Connect a client to a queue manager anonymously.

• Use self-signed certificates for mutual authentication of a client and queue manager
  Follow these sample instructions to implement mutual authentication between a client and a queue manager, by using self-signed TLS certificates.
• Use CA-signed certificates for mutual authentication of a client and queue manager
  Follow these sample instructions to implement mutual authentication between a client and a queue manager, by using CA-signed TLS certificates.
• Connect a client to a queue manager anonymously
  Follow these sample instructions to modify a system with mutual authentication to allow a queue manager to connect anonymously to another.

Parent topic: Security scenarios

Related information

• TLS CipherSpecs and CipherSuites in IBM MQ classes for Java
• TLS CipherSpecs and CipherSuites in IBM MQ classes for JMS
• Use certificates for the managed .NET client