Creating a self-signed certificate

You can create a self-signed certificate for a queue manager by using the createcert command on the command line.

About this task

A self-signed certificate can be used for testing a system while you are waiting for the officially signed certificate to be returned from the certificate authority (CA). The self-signed certificate is generated by the queue manager. As it is signed by the queue manager, and it certifies the identity of the queue manager, it is not suitable for use in a production system.

Procedure

  1. Enter the IBM® MQ administration mode by entering the following command:

    mqcli

  2. Create a self-signed certificate by entering the following command:

    createcert -m QMgrName -dn DistinguishedName -label LabelName

    Where:
    QMgrName
    Specifies the name of the queue manager that you want to create a certificate for.
    DistinguishedName
    Specifies the X.500 distinguished name that uniquely identifies the certificate.
    DistinguishedName is a string that is enclosed in double quotation marks. For example, CN=John Smith,O=IBM,OU=Test,C=GB. The CN, O, and C attributes are required.
    LabelName
    Specifies the name of the label that is associated with the certificate.
    If you do not specify a label name, a label is automatically generated. This label has the name ibmwebspheremqQMgrName, where QMgrName is the name of the queue manager in lowercase.
    Note: You can specify a number of optional parameters when you create a self-signed certificate. For more information, see createcert (create certificate).
  3. Optional: Exit the IBM MQ administration mode by entering the following command:

    exit

What to do next

After the self-signed certificate is generated, the public part of the certificate is extracted to a file that is placed in mqpubcert:///.

Add the public part of the certificate to the key repository of any communicating partners. For example, you can add the public part of the certificate to IBM MQ clients or to other queue managers. To add the public part of the certificate to other queue managers on the IBM MQ Appliance, use the addcert command. For more information, see Adding the public part of a self-signed certificate.

If you want to copy the certificate to another system to add it to the key repository of a communicating partner, you can use the copy command. For more information, see Downloading certificates from the appliance.