MQSeries.net :: View topic - export Certificate

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » General IBM MQ Support » export Certificate

export Certificate

« View previous topic :: View next topic »

Author

Message

bobbee

Posted: Wed May 19, 2021 5:29 am Post subject: export Certificate

Knight

Joined: 20 Sep 2001
Posts: 545
Location: Tampa

how do I export the certificate from a KDB creating a CRT file. MQ v9.1 GSK and I have openssl. Trying to extract the QMGR cert and key from a self signed.

I have the .key file. Cannot find the command for this. Even one command to do both would be better.

bobbee

Posted: Wed May 19, 2021 12:40 pm Post subject:

Knight

Joined: 20 Sep 2001
Posts: 545
Location: Tampa

Was doing this to setup Openshift Cluster using MQ Operator for mq v9.1.0.5

Code:

kdb ==> p12
gsk8capicmd -keydb -convert -db "/home/kubeadmin/SSL/SSLserver\bobbeeqmrg.kdb" -pw serverpass -type kdb -new_db"/home/kubeadmin/SSL/SSLserver\P12_new.p12" -new_pw serverpass -new_format p12 -expire 365

create crt and key from p12
openssl pkcs12 -in P12_new.p12 -nocerts -out filename.key
openssl pkcs12 -in P12_new.p12 -clcerts -nokeys -out filename.crt

exerk

Posted: Wed May 19, 2021 12:53 pm Post subject:

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

Why as a certificate file? Is there a reason it cannot be exported as a PKCS12 and imported into another key store?

The following should do it:

Code:

runmqakm -cert -export -db <exporting_kdb_path_and_name> -label <cert_label_name> -target <pkcs12_file_name> -target_pw <a_different_password> -target_type pkcs12 -stashed

To import it:

Code:

runmqakm -cert -import -file <pkcs12_file_name> -pw <password> -type pkcs12 -target <importing_kdb_path_and_name> -target_pw password -target_type cms -label <cert_label_name>

_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.

bobbee

Posted: Thu May 20, 2021 3:41 am Post subject:

Knight

Joined: 20 Sep 2001
Posts: 545
Location: Tampa

The doc, and another person in support who is working on this said when you set up the QMGR YAML it expects a .crt and a .key file in the deployment config. The doc is limited. But that is what it states now. I can force feed this in other formats, but that goes against the deployment architecture.

When handed lemons, make lemonade

THANKS!!
!

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » General IBM MQ Support » export Certificate

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP