Changing security policies in AMS

You can use Advanced Message Security to alter details of security policies that you have already defined.

Before you begin

The queue manager on which you want to operate must be running.
You must have the necessary authority to connect to the queue manager and create a security policy.
- On z/OS®, grant the authorities documented in The message security policy utility (CSQ0UTIL).
- On other platforms other than z/OS, you must grant the necessary +connect, +inq and +chg authorities using the setmqaut command.
For more information about configuring security see Setting up security.

About this task

To change security policies, apply the setmqspl command to an already existing policy providing new attributes.

Example

Here is an example of creating a policy named MYQUEUE on a queue manager named QMGR, specifying that messages are to be encrypted using the 3DES algorithm for authors (-a) having certificates with Distinguished Name (DN) of CN=alice,O=IBM,C=US and signed with the SHA256 algorithm for recipients (-r) having certificates with DN of CN=jeff,O=IBM,C=US.

setmqspl -m QMGR -p MYQUEUE -e 3DES -s SHA256 -a CN=jeff,O=IBM,C=US -r CN=alice,O=IBM,C=US

To alter this policy, issue the setmqspl command with all attributes from the example changing only the values you want to modify. In this example, previously created policy is attached to a new queue and its encryption algorithm is changed to AES256:

setmqspl -m QMGR -p MYQUEUE -e AES256 -s SHA256 -a CN=jeff,O=IBM,C=US -r CN=alice,O=IBM,C=US