IBM Support

IT17429: IBM MQ queue manager validation of a certificate against LDAP CRL server fails with AMQ9646

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • IBM MQ queue manager validation check of a certificate  against
    an LDAP CRL server fails with an AMQ9646.
    
     AMQ9646: Channel 'xyz' could not connect to any LDAP CRL
    servers.
    
     EXPLANATION:
     LDAP Certification Revocation List (CRL) servers were specified
    but a connection could not be established to any of them. The
    channel is 'xyz'; in some cases its name cannot be determined
      and so is shown as '????'. The channel did not start.
     ACTION:
     Check that the LDAP CRL server specifications are correct.   If
    they are, check that the servers are running and that the
    networking to access them is working correctly. Fix any errors
     found and restart the channel.
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    All IBM MQ user  with SSL enabled tries to use the Higher  LDAP
    protocol version.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    Some CRL servers require that a specific version of the LDAP
    protocol be used. MQ did not have any provision to ensure that
    its cryptographic libraries used a specific version of the LDAP
    protocol.
    

Problem conclusion

  • A new environment variable has been added:
    AMQ_SSL_LDAP_SERVER_VERSION
    
    This variable can be used to ensure that either LDAP v2 or LDAP
    v3 is used by MQ's cryptographic components.
    
    To request that LDAP v2 is used, set
    AMQ_SSL_LDAP_SERVER_VERSION=2 in the environment used to start
    the queue manager or channel.
    
    To request that LDAP v3 is used, set
    AMQ_SSL_LDAP_SERVER_VERSION=3 in the environment used to start
    the queue manager or channel.
    
    Details of whether a specific LDAP version is required for
    connections the CRL server should be obtained from the server
    owner.
    
    This variable does not affect LDAP connections established by
    the MQ queue manager for user authentication or user
    authorization.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v7.5       7.5.0.9
    v8.0       8.0.0.8
    v9.0 CD    9.0.4
    v9.0 LTS   9.0.0.2
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT17429

  • Reported component name

    WMQ BASE MULTIP

  • Reported component ID

    5724H7241

  • Reported release

    750

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-10-19

  • Closed date

    2017-06-30

  • Last modified date

    2017-06-30

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WMQ BASE MULTIP

  • Fixed component ID

    5724H7241

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSCPQ63","label":"APAR \/ Maintenance"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
30 June 2017