ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » Can we extract certificate expiry date using PCF APIs

Post new topic  Reply to topic
 Can we extract certificate expiry date using PCF APIs « View previous topic :: View next topic » 
Author Message
apdutta
PostPosted: Tue Jan 12, 2010 1:29 am    Post subject: Can we extract certificate expiry date using PCF APIs Reply with quote

Novice

Joined: 14 Dec 2004
Posts: 11

Is it possible to use MQ PCF APIs to get the expiry date of the SSL Certificate installed for a Channel on a Queue Manager ?

From a Systems Management perspective, is it possible to get advance notification in cases when a SSL certificate of a MQ Queue Manager is going to expire in the next say 5 days ?

In order to get that I was thinking of writing a custom code. But, I am not sure if using MQ PCF APIs I will be able to get the expiry date of the SSL certificate on a QM channel.
Back to top
View user's profile Send private message
zonko
PostPosted: Tue Jan 12, 2010 2:15 am    Post subject: Reply with quote

Voyager

Joined: 04 Nov 2009
Posts: 78

No, the expiry date is an attribute of the certificate, not the channel.
Back to top
View user's profile Send private message
bruce2359
PostPosted: Tue Jan 12, 2010 5:36 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9442
Location: US: west coast, almost. Otherwise, enroute.

Moved to Security forum.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
exerk
PostPosted: Tue Jan 12, 2010 5:53 am    Post subject: Re: Can we extract certificate expiry date using PCF APIs Reply with quote

Jedi Council

Joined: 02 Nov 2006
Posts: 6339

apdutta wrote:
Is it possible to use MQ PCF APIs to get the expiry date of the SSL Certificate installed for a Channel on a Queue Manager ?


And please note that queue managers have certificates, channels do not have certificates (although it would be nice to have).
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys.
Back to top
View user's profile Send private message
apdutta
PostPosted: Tue Jan 12, 2010 9:47 pm    Post subject: Reply with quote

Novice

Joined: 14 Dec 2004
Posts: 11

Thanks a lot for the replies.

I know that I can use PCF APIs to get the file path of the certificate key repository for a queue manager. After I get that, do I have any MQ Java / PCF API to which I can give this path and it would return me the expiry date of the certificate present in that key repository ?

Similar thing is possible using the gskit tool that is available with MQ installs.
C:\IBM\WMQ\gskit\ibm\gsk7\bin>gsk7cmd -keydb -expiry -db c:\IBM\WMQ\qmgrs\QM1\ssl\key.kdb -pw xxxxx

I want to do this thing using Java. Is that possible ?
Back to top
View user's profile Send private message
mqjeff
PostPosted: Wed Jan 13, 2010 3:00 am    Post subject: Reply with quote

Grand Master

Joined: 25 Jun 2008
Posts: 17447

It may be possible to do things in Java to enquire about a certificate from a keystore.

It is not possible to do this using any MQ APIs, in Java or otherwise. There is no MQ API that will do this.

You may also find it somewhat challenging to read certificates that are not kept in a Java KeyStore (jks) file from a Java program.
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Wed Jan 13, 2010 10:30 am    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20729
Location: LI,NY

mqjeff wrote:
It may be possible to do things in Java to enquire about a certificate from a keystore.

It is not possible to do this using any MQ APIs, in Java or otherwise. There is no MQ API that will do this.

You may also find it somewhat challenging to read certificates that are not kept in a Java KeyStore (jks) file from a Java program.


Also note that it is against security guidelines to allow just anybody to retrieve that information. Retrieving that information using MQ is equivalent to an anonymous access...


_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
bruce2359
PostPosted: Wed Jan 13, 2010 10:39 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9442
Location: US: west coast, almost. Otherwise, enroute.

Quote:
It is not possible to do this using any MQ APIs, in Java or otherwise. There is no MQ API that will do this.

Certificates, the keystore and other ssl thingies are part of a service (like LDAP, for example), and are not mq objects. Therefore, the MQI calls do not apply.

SSL implements its own set of APIs. Do a quick google search for ssl+api.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
apdutta
PostPosted: Sun Jan 17, 2010 10:04 pm    Post subject: Reply with quote

Novice

Joined: 14 Dec 2004
Posts: 11

understand.. appreciate the replies...

here is the scenario that I face...

we have a bunch of MQ Queue Managers (>100 ...most on windows machines) ...Many of them have SSL Certificates installed in them for inter Queue Manager connections or client connections. A major issue we face is that such certificates expire and we come to know of that only when there is a connection failure due to certificate expiry on a Queue Manager.

You must have guessed : We need to have automated advance notifications. Any ideas on how I can get advance notifications of expiring QM SSL certificates ?

I was considering writing a script...

Each Queue Manager has the SSL configured with the path provided to its key database file (kdb file). The kdb file contains the SSL certificates for that QM.

In my case, for many of the Queue Managers the path where the key database file (kdb) file is stored is actually a mapped drive on that windows machine.

The gsk7cmd command can give me the expiry date of a certificate which resides inside a kdb file. I would like to execute this command on a central machine and give it the path to the kdb files of various QMs in sequence. Would this work ? My problem is that this command is not accepting a path which looks like \\anothermachine\g$\somefolder\ssl\key.kdb.... Any ideas ?

Thanks...
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Sun Jan 17, 2010 10:11 pm    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20729
Location: LI,NY

Your script could define as local drive y
Code:
net use y: \\anothermachine\g$

The rest is then up to you to attach / detach the drive and use gskit to determine certificate expiration date.

Have fun...
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » Can we extract certificate expiry date using PCF APIs
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.