MQSeries.net :: View topic

MQWays · Posted: Fri May 02, 2008 1:03 am Post subject:

hi,

With the below set of entries, I am experiencing
"All the signer certificates must exist in the key database" error.

Steps executed

1. Created key db

gsk7cmd -keydb -create -db /var/mqm/qmgrs/QMGRA/ssl/key.kdb -pw test -type cms -expire 7300 -stash

2. Created certificate request

gsk7cmd -certreq -create -db /var/mqm/qmgrs/QMGRA/ssl/key.kdb -pw test -label ibmwebspheremqqmgra -dn "CN=ONE, O=TWO, C=US" -file /var/mqm/qmgrs/QMGRA/ssl/certreq_QMGRA.arm"

3. Submitted the request in Microsoft IIS & issued the certificate via Microsoft Certificate Authortity. Downloaded the CA & CA-signed certificate (Base64)

4. Added the CA certificate

gsk7cmd -cert -add -db /var/mqm/qmgrs/QMGRA/ssl/key.kdb -pw test -label certnew -file /var/mqm/qmgrs/QMGRA/ssl/certnew.cer -format ascii

5. Added the CA signed certificate

gsk7cmd -cert -receive -file /var/mqm/qmgrs/QMGRA/ssl/ibmwebspheremqqmgra.cer -db /var/mqm/qmgrs/QMGRA/ssl/key.kdb -pw test -format ascii

Response: "All the signer certificates must exist in the key database"

Overview: I had successfully enabled MQ SSL on different machine before with exactly the above steps. Now I am trying to set it up on a new machine but to fail. On the new box, I have used the same Q Mgr name, same label and same distinguished name.

Then I thought it may be a duplication issue in the Microsoft Certificate Authority. So I changed the distinguished name in step 2. Yet the same error. The only thing left is that I change the label name in case Certificate Authority keeps track of the previously submitted Label. But then the label should be named after the Q Mgr and I have to maintain the Q Manager name.

Seek your advise....

Thanks.