Requesting a personal certificate for your PKCS #11 hardware
Use this procedure for either a queue manager or an IBM® WebSphere® MQ MQI client to request a personal certificate for your cryptographic hardware.
Using the iKeyman user interface
About this task
Note: WebSphere MQ does not support SHA-3 or SHA-5 algorithms.
You can use the digital signature algorithm names SHA384WithRSA and
SHA512WithRSA because both algorithms are members of the SHA-2 family.
The digital signature algorithm names SHA3WithRSA and SHA5WithRSA are deprecated because they are an abbreviated form of SHA384WithRSA and SHA512WithRSA respectively.
Procedure
To request a personal certificate from the iKeyman user interface, complete the following steps:
Using the command line
Procedure
Use the following commands to request a personal certificate by using either the
runmqckm or runmqakm command:
- Using runmqckm:
runmqckm -certreq -create -db filename -pw password -label label -dn distinguished_name -size key_size -file filename -sig_alg algorithm
Instead of
-dn distinguished_name
, you can use-san_dsname DNS_names
,-san_emailaddr email_addresses
, or-san_ipaddr IP_addresses
. - Using runmqakm:
runmqakm -certreq -create -db filename -pw password -label label -dn distinguished_name -size key_size -file filename -fips -sig_alg algorithm
- -db filename
- Specifies the fully qualified file name of a CMS key database.
- -pw password
- Specifies the password for the CMS key database.
- -label label
- Specifies the key label attached to the certificate.
- -dn distinguished_name
- Specifies the X.500 distinguished name enclosed in double quotation marks. At least one attribute is required. You can supply multiple OU and DC attributes.
- -size key_size
- Specifies the key size. If you are using runmqckm , the value can be 512 or 1024. If you are using runmqakm, the value can be 512, 1024, or 2048.
- -file filename
- Specifies the file name for the certificate request.
- -fips
- Specifies that the command is run in FIPS mode. This mode disables the use of the BSafe cryptographic library. Only the ICC component is used and this component must be successfully initialized in FIPS mode. When in FIPS mode, the ICC component uses algorithms that are FIPS 140-2 validated. If the ICC component does not initialize in FIPS mode, the runmqakm command fails.
- -sig_alg
- For runmqckm, specifies the asymmetric signature algorithm used for the creation of the entry's key pair. The value can be MD2_WITH_RSA, MD2WithRSA, MD5_WITH_RSA, MD5WithRSA, SHA1WithDSA , SHA1WithRSA, SHA256_WITH_RSA, SHA256WithRSA, SHA2WithRSA, SHA384_WITH_RSA , SHA384WithRSA, SHA512_WITH_RSA , SHA512WithRSA, SHA_WITH_DSA, SHA_WITH_RSA, SHAWithDSA, or SHAWithRSA . The default value is SHA1WithRSA
- -sig_alg
- For runmqakm, specifies the hashing algorithm used during the creation of a certificate request. This hashing algorithm is used to create the signature associated with the newly created certificate request. The value can be md5, MD5_WITH_RSA, MD5WithRSA, SHA_WITH_DSA , SHA_WITH_RSA, sha1, SHA1WithDSA , SHA1WithECDSA, SHA1WithRSA, sha224, SHA224_WITH_RSA, SHA224WithDSA , SHA224WithECDSA, SHA224WithRSA , sha256, SHA256_WITH_RSA, SHA256WithDSA, SHA256WithECDSA, SHA256WithRSA, SHA2WithRSA, sha384 , SHA384_WITH_RSA, SHA384WithECDSA , SHA384WithRSA, sha512, SHA512_WITH_RSA, SHA512WithECDSA, SHA512WithRSA, SHAWithDSA, SHAWithRSA , EC_ecdsa_with_SHA1, EC_ecdsa_with_SHA224 , EC_ecdsa_with_SHA256, EC_ecdsa_with_SHA384 , or EC_ecdsa_with_SHA512. The default value is SHA1WithRSA.
- -san_dnsname DNS_names
- Specifies a comma-delimited or space-delimited list of DNS names for the entry being created.
- -san_emailaddr email_addresses
- Specifies a comma-delimited or space-delimited list of email addresses for the entry being created.
- -san_ipaddr IP_addresses
- Specifies a comma-delimited or space-delimited list of IP addresses for the entry being created.