MQSeries.net :: View topic

Inforz · Posted: Mon Nov 11, 2019 1:52 am Post subject:

Hi,

My work environment has a MQ cluster with 6 qmgrs in it, out of which two are FR and rest are PR.

All of the below qmgrs are of MQ v7.0.1.9

Server1(AIX 1.6) has below qmgrs
EF1 - FR
EG1 - PR
EB1 - PR

Server2(AIX 1.6) has below qmgrs
EF2 - FR
EG2 - PR
EB2 - PR

EG1 & EB1 have cluster channels defined to EF1
EG2 & EB2 have cluster channels defined to EF2

SSL renewal was performed recently and the DN was advised by signing authority to be changed on the existing values of the Org(O) and Email attributes and it was updated as advised for the new certs.

Now when applying new certs to each qmgrs and doing ssl refresh(refresh security type(ssl)), cluster channels went in retrying state with below error when I did ping of those channels.

AMQ9636: SSL distinguished name does not match peer name, channel ''.

I made the SSLpeer attributes to generic ie., SSLPEER(CN="*",OU="*",O="*")
(ie., for all cluster channels did a stop chl, then updated ssl peer as above, then started it)
After this change the channels were still in retrying state.

when displayed the channel, I see they are updated as did for the sslpeer value.

However, when I did a dis clusqmgr(*), on server1, on its 3 qmgrs in it, I see the output has ssl peer value updated only for the qmgrs present in server1 and was showing the old ssl peer value that was present before the SSL renewal for the qmgrs present in server2.

Similarly, when I did a dis clusqmgr(*), on server2, on its 3 qmgrs in it, I see the output has ssl peer value updated only for the qmgrs present in server2 and was showing the old ssl peer value that was present before the SSL renewal for the qmgrs present in server1.

Did a refresh cluster repos(yes) as well on both cluster FRs, but no change.

Please advise.

Thanks,