Working with revoked certificates

Digital certificates can be revoked by Certificate Authorities. You can check the revocation status of certificates using OCSP, or CRLs on LDAP servers, depending on platform.

During the TLS handshake, the communicating partners authenticate each other with digital certificates. Authentication can include a check that the certificate received can still be trusted. Certificate Authorities (CAs) revoke certificates for various reasons, including:
  • The owner has moved to a different organization
  • The private key is no longer secret

CAs publish revoked personal certificates in a Certificate Revocation List (CRL). CA certificates that have been revoked are published in an Authority Revocation List (ARL).

On the following platforms, IBM® MQ SSL support checks for revoked certificates using OCSP (Online Certificate Status Protocol) or using CRLs and ARLs on LDAP (Lightweight Directory Access Protocol) servers. OCSP is the preferred method.
  • [Linux]Linux®
  • [UNIX]UNIX
  • [Windows]Windows
IBM MQ classes for Java and IBM MQ classes for JMS cannot use the OCSP information in a client channel definition table file. However, you can configure OCSP as described in Using Online Certificate Protocol.
On the following platforms, and IBM MQ SSL support checks for revoked certificates using CRLs and ARLs on LDAP servers only:
  • [IBM i]IBM i
  • [z/OS]z/OS®

For more information about Certificate Authorities, see Digital certificates.