1. 首頁
  2. 問答
  3. IBM MQ錯誤代碼2397使用java SSL

IBM MQ錯誤代碼2397使用java SSL

2012-05-29 39 views
2

我正在嘗試使用我的java代碼設置2路SSl。我成功地做到了這一點，即服務器證書從我身邊得到驗證，但是當涉及到兩種方式時，我得到一個2397錯誤代碼。IBM MQ錯誤代碼2397使用java SSL

步驟，然後我有：

  1. 使用的keytool自簽名證書創建密鑰庫，在MQ服務器的信任部署。
  2. 爲MQ服務器創建密鑰庫並創建自簽名證書。
  3. 在我的信任庫中部署MQ服務器的證書。

然後我嘗試運行我的java代碼。這工作正常沒有SSL或單向SSL.But雙向握手，如果失敗。下面是代碼和堆棧跟蹤：

//code to create MQ connectivity 
    public static void main(String [] args){ 
    System.setProperty("javax.net.debug","ssl"); 
    //keystore path 
    System.setProperty("javax.net.ssl.keyStore", "C:/keystores/keystore.jks");    
    System.setProperty("javax.net.ssl.keyStorePassword", "password"); 
    //trsutstore path 
    System.setProperty("javax.net.ssl.trustStore", "C:/keystores/truststore.jks"); 
    System.setProperty("javax.net.ssl.trustStorePassword", "password"); 
    //cipher spec   
    MQEnvironment.sslCipherSuite = "SSL_RSA_WITH_NULL_MD5"; 
    MQEnvironment.hostname = "*****-ws3717";//system name 
    MQEnvironment.port = 1414; 
    MQEnvironment.channel = "channel_name";//channel name 
    MQQueueManager qm = null; 
    try { qm = new MQQueueManager("QMNGR"); 
     System.out.println("Conn Successs!!!"); 
    } catch (MQException e) { 
     e.printStackTrace(); 
    } 
    finally { 
     try { 
      qm.disconnect(); 
     } catch (Exception e) { 
      e.printStackTrace(); 
      e.getCause(); 
     } 
    } 
    } }

堆棧跟蹤如下：

keyStore is : C:/keystores/keystore.jks 
keyStore type is : jks 
keyStore provider is : 
init keystore 
init keymanager of type SunX509 
*** 
found key for : selfsigned 
chain [0] = [ 
[ 
    Version: V3 
    Subject: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4 
    Key: Sun RSA public key, 1024 bits 
    modulus: 132473562370742919150140985227175013875110053845431438145351913928668686945002725183702560702247749924970161010103451411451345824467592557656888776558245848713650717773344294766986771753500118311618188922138349812131167438364266468003061810102502957510761089213138803410346480285664890149111581898928681089463 
    public exponent: 65537 
    Validity: [From: Fri May 25 13:54:00 IST 2012, 
       To: Sat May 25 13:54:00 IST 2013] 
    Issuer: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    SerialNumber: [ 4fbf41a0] 
] 
    Algorithm: [MD5withRSA] 
    Signature: 
0000: 46 D0 CC DF AB 5F 6F D3 37 33 E1 64 F7 1B F7 3F F...._o.73.d...? 
0010: 98 95 06 09 F9 84 C8 3A 65 CF A7 24 BB 46 95 DF .......:e..$.F.. 
0020: 8B 30 F2 BC 5C F9 CC 31 E4 36 53 43 BB 50 1B EF .0..\..1.6SC.P.. 
0030: 8C 9B DB C0 41 C9 2C 37 AD B6 1D 30 BF 6E 75 E4 ....A.,7...0.nu. 
0040: A9 05 E7 30 5A B1 30 84 6B 8E B7 7A 83 2D 33 01 ...0Z.0.k..z.-3. 
0050: A1 44 86 A0 11 30 C3 4D 5B 68 7E 0B 09 48 03 CC .D...0.M[h...H.. 
0060: DF C5 97 AD 87 40 DC 2A 9A 3D ED FC 27 D3 8B 4F [email protected]*.=..'..O 
0070: F0 21 02 E8 62 6B 05 63 57 BB E8 4D 33 EA 35 9E .!..bk.cW..M3.5. 
] 
*** 
trustStore is: C:\keystores\truststore.jks 
trustStore type is : jks 
trustStore provider is : 
init truststore 
adding as trusted cert: 
    Subject: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    Issuer: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    Algorithm: RSA; Serial number: 0x4fbf4261 
    Valid from Fri May 25 13:57:13 IST 2012 until Sat May 25 13:57:13 IST 2013 
trigger seeding of SecureRandom 
done seeding SecureRandom 
Allow unsafe renegotiation: false 
Allow legacy hello messages: true 
Is initial handshake: true 
Is secure renegotiation: false 
%% No cached client session 
*** ClientHello, SSLv3 
RandomCookie: GMT: 1321485794 bytes = { 138, 193, 95, 113, 86, 252, 250, 50, 154, 121, 73, 8, 93, 116, 115, 184, 182, 142, 240, 205, 15, 250, 172, 171, 111, 5, 122, 52 } 
Session ID: {} 
Cipher Suites: [SSL_RSA_WITH_NULL_MD5] 
Compression Methods: { 0 } 
Extension renegotiation_info, renegotiated_connection: <empty> 
*** 
main, WRITE: SSLv3 Handshake, length = 52 
main, READ: SSLv3 Handshake, length = 4875 
*** ServerHello, SSLv3 
RandomCookie: GMT: 1321485794 bytes = { 250, 173, 248, 90, 241, 136, 107, 119, 99, 92, 80, 19, 223, 223, 152, 131, 216, 115, 242, 56, 198, 135, 156, 111, 210, 234, 220, 103 } 
Session ID: {240, 31, 0, 0, 80, 56, 194, 89, 112, 238, 203, 154, 79, 75, 68, 48, 106, 203, 19, 130, 88, 88, 88, 88, 226, 70, 196, 79, 13, 0, 0, 0} 
Cipher Suite: SSL_RSA_WITH_NULL_MD5 
Compression Method: 0 
*** 
Warning: No renegotiation indication extension in ServerHello 
%% Created: [Session-1, SSL_RSA_WITH_NULL_MD5] 
** SSL_RSA_WITH_NULL_MD5 
*** Certificate chain 
chain [0] = [ 
[ 
    Version: V3 
    Subject: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4 
    Key: Sun RSA public key, 1024 bits 
    modulus: 105605049659295333895264877648371480987144339115417104117025065956957634413900327625548229515098843172709660865042903412409581107015480309223474293490705595126088958625491899627683399717294708677347640098462040771799700233921554682196524988217754821345297656825451441457385676164016790486091736694366149540953 
    public exponent: 65537 
    Validity: [From: Fri May 25 13:57:13 IST 2012, 
       To: Sat May 25 13:57:13 IST 2013] 
    Issuer: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    SerialNumber: [ 4fbf4261] 
] 
    Algorithm: [MD5withRSA] 
    Signature: 
0000: 81 F5 2C 2A 77 63 F1 CD D8 31 E1 BE B5 9B 28 C5 ..,*wc...1....(. 
0010: 6B EA 24 BB 5C 3D EB D0 EB E3 86 2E D7 1C 0D 92 k.$.\=.......... 
0020: 36 A2 79 13 BC 74 40 C4 BF 7C F7 1B 05 8C 6B CF [email protected] 
0030: EB 2C C2 0D E3 40 F7 F0 95 66 B6 85 AE 84 66 C9 .,[email protected] 
0040: B7 C5 29 BE 71 1F 28 C0 83 1C 94 41 08 2A 44 45 ..).q.(....A.*DE 
0050: 99 FD C5 77 28 26 FC 50 A3 69 32 BD F5 8B 0C A6 ...w(&.P.i2..... 
0060: 13 21 0F BA B2 C6 A2 71 18 17 94 31 3B 7E 88 63 .!.....q...1;..c 
0070: C0 01 76 DC 60 47 BB 3F 2F 7E 2A 73 84 DA 60 79 ..v.`G.?/.*s..`y 
] 
*** 
Found trusted certificate: 
[ 
[ 
    Version: V3 
    Subject: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4 
    Key: Sun RSA public key, 1024 bits 
    modulus: 105605049659295333895264877648371480987144339115417104117025065956957634413900327625548229515098843172709660865042903412409581107015480309223474293490705595126088958625491899627683399717294708677347640098462040771799700233921554682196524988217754821345297656825451441457385676164016790486091736694366149540953 
    public exponent: 65537 
    Validity: [From: Fri May 25 13:57:13 IST 2012, 
       To: Sat May 25 13:57:13 IST 2013] 
    Issuer: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    SerialNumber: [ 4fbf4261] 
] 
    Algorithm: [MD5withRSA] 
    Signature: 
0000: 81 F5 2C 2A 77 63 F1 CD D8 31 E1 BE B5 9B 28 C5 ..,*wc...1....(. 
0010: 6B EA 24 BB 5C 3D EB D0 EB E3 86 2E D7 1C 0D 92 k.$.\=.......... 
0020: 36 A2 79 13 BC 74 40 C4 BF 7C F7 1B 05 8C 6B CF [email protected] 
0030: EB 2C C2 0D E3 40 F7 F0 95 66 B6 85 AE 84 66 C9 .,[email protected] 
0040: B7 C5 29 BE 71 1F 28 C0 83 1C 94 41 08 2A 44 45 ..).q.(....A.*DE 
0050: 99 FD C5 77 28 26 FC 50 A3 69 32 BD F5 8B 0C A6 ...w(&.P.i2..... 
0060: 13 21 0F BA B2 C6 A2 71 18 17 94 31 3B 7E 88 63 .!.....q...1;..c 
0070: C0 01 76 DC 60 47 BB 3F 2F 7E 2A 73 84 DA 60 79 ..v.`G.?/.*s..`y 
] 
*** CertificateRequest 
Cert Types: RSA 
Cert Authorities: 
<[email protected], CN=Thawte Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA> 
<[email protected], CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA> 
<[email protected], CN=Thawte Personal Basic CA, OU=Certification Services Division, O=Thawte Consulting, L=Cape Town, ST=Western Cape, C=ZA> 
<[email protected], CN=Thawte Personal Freemail CA, OU=Certification Services Division, O=Thawte Consulting, L=Cape Town, ST=Western Cape, C=ZA> 
<[email protected], CN=Thawte Personal Premium CA, OU=Certification Services Division, O=Thawte Consulting, L=Cape Town, ST=Western Cape, C=ZA> 
<CN=VeriSign Class 1 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> 
<CN=VeriSign Class 2 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> 
<CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> 
<CN=VeriSign Class 4 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> 
<OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 1 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US> 
<OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US> 
<OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US> 
<OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 4 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US> 
<OU=Class 1 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> 
<OU=Class 2 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> 
<OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> 
<CN=VeriSign Class 3 Secure Server CA, OU=Terms of use at https://www.verisign.com/rpa (c)05, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> 
<CN=Entrust.net Secure Server Certification Authority, OU=(c) 1999 Entrust.net Limited, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), O=Entrust.net, C=US> 
<CN=Entrust.net Certification Authority (2048), OU=(c) 1999 Entrust.net Limited, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), O=Entrust.net> 
<CN=Entrust.net Client Certification Authority, OU=(c) 1999 Entrust.net Limited, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., O=Entrust.net, C=US> 
<CN=Entrust.net Client Certification Authority, OU=(c) 2000 Entrust.net Limited, OU=www.entrust.net/GCCA_CPS incorp. by ref. (limits liab.), O=Entrust.net> 
<CN=Entrust.net Secure Server Certification Authority, OU=(c) 2000 Entrust.net Limited, OU=www.entrust.net/SSL_CPS incorp. by ref. (limits liab.), O=Entrust.net> 
<CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN> 
*** ServerHelloDone 
matching alias: selfsigned 
*** Certificate chain 
chain [0] = [ 
[ 
    Version: V3 
    Subject: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4 

    Key: Sun RSA public key, 1024 bits 
    modulus: 132473562370742919150140985227175013875110053845431438145351913928668686945002725183702560702247749924970161010103451411451345824467592557656888776558245848713650717773344294766986771753500118311618188922138349812131167438364266468003061810102502957510761089213138803410346480285664890149111581898928681089463 
    public exponent: 65537 
    Validity: [From: Fri May 25 13:54:00 IST 2012, 
       To: Sat May 25 13:54:00 IST 2013] 
    Issuer: CN=Pooja Joshi, OU=SGW, O=SUNGARD, L=PUNE, ST=MH, C=IN 
    SerialNumber: [ 4fbf41a0] 
] 
    Algorithm: [MD5withRSA] 
    Signature: 
0000: 46 D0 CC DF AB 5F 6F D3 37 33 E1 64 F7 1B F7 3F F...._o.73.d...? 
0010: 98 95 06 09 F9 84 C8 3A 65 CF A7 24 BB 46 95 DF .......:e..$.F.. 
0020: 8B 30 F2 BC 5C F9 CC 31 E4 36 53 43 BB 50 1B EF .0..\..1.6SC.P.. 
0030: 8C 9B DB C0 41 C9 2C 37 AD B6 1D 30 BF 6E 75 E4 ....A.,7...0.nu. 
0040: A9 05 E7 30 5A B1 30 84 6B 8E B7 7A 83 2D 33 01 ...0Z.0.k..z.-3. 
0050: A1 44 86 A0 11 30 C3 4D 5B 68 7E 0B 09 48 03 CC .D...0.M[h...H.. 
0060: DF C5 97 AD 87 40 DC 2A 9A 3D ED FC 27 D3 8B 4F [email protected]*.=..'..O 
0070: F0 21 02 E8 62 6B 05 63 57 BB E8 4D 33 EA 35 9E .!..bk.cW..M3.5. 
] 
*** 
*** ClientKeyExchange, RSA PreMasterSecret, SSLv3 
main, WRITE: SSLv3 Handshake, length = 711 
SESSION KEYGEN: 
PreMaster Secret: 
0000: 03 00 3D 04 C8 EF 08 83 A4 EF 85 1C D9 96 A0 77 ..=............w 
0010: 32 2A A5 43 14 98 11 6F DD 01 52 73 4D DF B4 5A 2*.C...o..RsM..Z 
0020: C5 2E FC 2A C0 F6 C2 9B 11 23 B2 C0 7B 59 E8 96 ...*.....#...Y.. 
CONNECTION KEYGEN: 
Client Nonce: 
0000: 4F C4 46 E2 8A C1 5F 71 56 FC FA 32 9A 79 49 08 O.F..._qV..2.yI. 
0010: 5D 74 73 B8 B6 8E F0 CD 0F FA AC AB 6F 05 7A 34 ]ts.........o.z4 
Server Nonce: 
0000: 4F C4 46 E2 FA AD F8 5A F1 88 6B 77 63 5C 50 13 O.F....Z..kwc\P. 
0010: DF DF 98 83 D8 73 F2 38 C6 87 9C 6F D2 EA DC 67 .....s.8...o...g 
Master Secret: 
0000: C0 20 A8 BC D1 A7 06 B0 C5 07 CA A7 83 C5 35 9E . ............5. 
0010: 20 AB B6 28 8C 7E EF 14 CB 9D C1 ED C5 62 F8 A1 ..(.........b.. 
0020: 6A DE 9F AF 16 5B 2F 1D 21 8F A3 2C F7 B9 3D 36 j....[/.!..,..=6 
Client MAC write Secret: 
0000: 09 E8 CE 6C D1 2D 43 86 7E 74 1C 5F 68 DA E2 AE ...l.-C..t._h... 
Server MAC write Secret: 
0000: CE 62 DA F7 2C F2 2B 4A AD 47 8F 61 BD 58 51 BD .b..,.+J.G.a.XQ. 
... no encryption keys used 
... no IV used for this cipher 
*** CertificateVerify 
main, WRITE: SSLv3 Handshake, length = 134 
main, WRITE: SSLv3 Change Cipher Spec, length = 1 
*** Finished 
verify_data: { 4, 127, 139, 212, 93, 181, 170, 62, 121, 196, 243, 156, 251, 103, 206, 222, 2, 10, 84, 35, 186, 251, 144, 6, 31, 97, 135, 179, 160, 127, 204, 93, 100, 140, 74, 79 } 
*** 
main, WRITE: SSLv3 Handshake, length = 56 
main, waiting for close_notify or alert: state 1 
main, Exception while waiting for close java.net.SocketException: Software caused connection abort: recv failed 
main, handling exception: java.net.SocketException: Software caused connection abort: recv failed 
MQJE001: An MQException occurred: Completion Code 2, Reason 2397 
MQJE030: IOException during security flows 
MQJE001: Completion Code 2, Reason 2397 
com.ibm.mq.MQException: MQJE001: Completion Code 2, Reason 2397 
    at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:219) 
    at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:318) 
    at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:338) 
    at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:84) 
    at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:168) 
    at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:772) 
    at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:697) 
    at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:657) 
    at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:153) 
    at com.ibm.mq.MQQueueManager.<init>(MQQueueManager.java:451) 
    at com.test.SSlTest.main(SSlTest.java:68) 
Caused by: java.net.SocketException: Software caused connection abort: recv failed 
    at java.net.SocketInputStream.socketRead0(Native Method) 
    at java.net.SocketInputStream.read(SocketInputStream.java:129) 
    at com.sun.net.ssl.internal.ssl.InputRecord.readFully(InputRecord.java:293) 
    at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:331) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:798) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1493) 
    at com.sun.net.ssl.internal.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:103) 
    at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:689) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:985) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:904) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:238) 
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) 
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1149) 
    at com.ibm.mq.SSLHelper.configureSSLSocket(SSLHelper.java:567) 
    at com.ibm.mq.SSLHelper.createSSLSocket(SSLHelper.java:150) 
    at com.ibm.mq.MQInternalCommunications.createSocketConnection(MQInternalCommunications.java:2264) 
    at com.ibm.mq.MQv6InternalCommunications$1.run(MQv6InternalCommunications.java:157) 
    at java.security.AccessController.doPrivileged(Native Method) 
    at com.ibm.mq.MQv6InternalCommunications.initialize(MQv6InternalCommunications.java:154) 
    at com.ibm.mq.MQv6InternalCommunications.<init>(MQv6InternalCommunications.java:102) 
    at com.ibm.mq.MQSESSIONClient.MQCONNX(MQSESSIONClient.java:1337) 
    at com.ibm.mq.MQSESSIONClient.MQCONN(MQSESSIONClient.java:1246) 
    at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:184) 
    ... 10 more

請幫助我....

來源

2012-05-29 user1421183

回答

2

你的調試過程是完美的！首次設置SSL時，請始終先不使用SSL（驗證通道名稱拼寫，偵聽器端口等），然後使用匿名SSL進行檢查（驗證客戶端是否可以驗證QMgr的證書），然後使用相互驗證的SSL進行檢查。

在這種情況下，失敗是在最後一步。通過這一點，我們知道QMgr可以讀取它的KDB，並且客戶端可以讀取它的信任存儲。此時幾乎沒有可能的問題，主要的問題是客戶端找不到其私鑰或者QMgr無法驗證客戶端密鑰。

由於跟蹤顯示客戶端能夠訪問其密鑰，我們知道這不是問題。那麼在大多數情況下，這就表明QMgr方面存在問題。在這種情況下典型的有兩個問題。

  1. 客戶端的密鑰未正確加載到QMgr的密鑰庫（或者可能是以前版本的密鑰已加載）。
  2. QMgr沒有加載當前版本的KDB。

由於您提供了堆棧跟蹤，並且密鑰交換的所有其他方面看起來都很好，所以我會大膽猜測並說出原因是上面的＃2。如果是這樣，那麼它很容易修復。您可以使用runmqsc輸入命令REFRESH SECURITY TYPE(SSL)，這會導致QMgr停止所有SSL通道並從其緩存中清除KDB。 WMQ資源管理器中有一個等效的命令，通過右鍵單擊QMgr找到。或者只是反彈QMgr，它完成同樣的事情。這兩種方法中的任何一種都會導致QMgr重新加載KDB，從而使其能夠訪問新證書。

更新：
對不起，這不是問題。您可以重新創建失敗並查看QMgr的錯誤日誌嗎？失敗後您應該在/var/mqm/qmgrs/<qmgrname>/errors/AMQERR01.LOG的底部看到錯誤。

您也可以在客戶端和QMgr上轉儲證書詳細信息，以驗證它們是否匹配，並在QMgr的kdb中標記爲可信。你已經知道如何用keytool做到這一點。根據您的WMQ服務器版本，您可以使用gsk7capicmd或gsk8capicmd或WMQ v7.1 runmqakm。首先使用-cert -list命令轉儲QMgr的KDB，然後使用-cert -details轉儲客戶端的證書，並將結果作爲問題的更新發布。

該命令將爲您提供所需參數的幫助。如果您想了解詳細信息，請轉至https://t-rob.net/wmq/，您可以在該頁面中途找到指向GSKit 7和GSKit 8手冊的鏈接。 runmqakm命令是對​​GSKit 8的封裝，因此如果QMgr運行WMQ v7.1，請使用GSKit 8手冊。

來源

2012-05-29 04:51:24

+0

謝謝Rob！但我仍然無法訪問它。 – user1421183

+0

我已經更新了我的答案。你看見了嗎？ –

+0

真棒!!!!感謝GSKit7/8手冊。拯救生命！ – shellter

相關問題

 相關問題