Create test certificates

In this scenario, we can create a self-signed certificate which we can use for testing MQIPT routes. This certificate can be used by an MQIPT route to identify itself to a remote peer.

Self-signed certificates can be useful in test scenarios where we must ensure TLS connectivity without paying a Certificate Authority (CA) for a certificate. However, we should not use self-signed certificates in production environments. For certificates for production usage, see Create a key ring file.

Before starting

• Before you start to use this scenario, make sure that we have completed the prerequisite tasks listed in Getting started with IBM MQ Internet Pass-Thru.

We can either use the mqiptkeycmd (iKeyman) command-line interface (CLI) or the mqiptkeyman GUI to request the certificate. We should then specify the key ring file that contains the certificate in the SSLServerKeyRing or SSLClientKeyRing MQIPT route property, depending on whether the certificate is for use by inbound or outbound connections.

Procedure

Use one of the following methods to create test certificates:

• Use the command-line interface (CLI)
  1. Enter the following command to create a new PKCS #12 key ring file:

     mqiptKeycmd -keydb -create -db server_name.pfx -pw password -type pkcs12

     where:
     • -db specifies the name of the key ring file (server_name.pfx).
     • -pw specifies the key ring password (password) that you must later encrypt using the mqiptPW utility.

  2. Enter the following command to create a self-signed personal certificate for testing purposes:

     mqiptKeycmd -cert -create -db server_name.pfx -pw password -type pkcs12
                 -label label -dn DN_identity
                 -sig_alg signature_algorithm -size key_size

     where:
     • -label specifies a unique name of our choice; it is preferable not to include space characters.
     • -dn specifies the appropriate Distinguished Name identity for the MQIPT route; for example, "CN=Test Certificate,OU=Sales,O=Example,C=US".
     • -sig_alg specifies the hash algorithm; for example, SHA256WithRSA.
     • -size specifies the size of the public key; for example, 2048.

     If we use the example values given, this command creates a digital certificate with a 2048-bit RSA public key and a digital signature that uses RSA with the SHA-256 hash algorithm.

     When creating a certificate, take care to choose an appropriate public key encryption algorithm, key size, and digital signature algorithm for the organization's security needs. See Digital certificate considerations for MQIPT for more information.

• Use the GUI
  1. Open the GUI by running the following command:

     mqiptKeyman

  2. Click Key database file > New.
  3. Select the type of the key database; for example, PKCS12.
  4. Enter the file name and location for the new key ring file. Click OK.
  5. Enter a password for the new key ring file. Enter the password a second time to confirm. This is the key ring password that we must later encrypt using the mqiptPW utility. Click OK to create the new personal-certificate key ring file.
  6. Create the new self-signed personal certificate by clicking Create > New Self-Signed Certificate.
  7. Enter a label for the new certificate in the Key Label field. The label can be any unique name you choose; it is preferable not to include space characters.
  8. Select the key size and digital signature algorithm as appropriate for the organization's security needs. See Digital certificate considerations for MQIPT for more information.
  9. Enter the appropriate Distinguished Name identity for the MQIPT route in the optional DN fields, then click OK.

What to do next

mqiptPW