IT32081: Error log incorrectly reports remote certificate validation failed when local certificate is invalid

APAR status

• Closed as program error.

Error description

• When an invalid certificate is configured locally for a channel
  instance, or client application, the channel fails to start
  reporting AMQ9654 -
  "Validation checks for the remote personal certificate failed".
  
  This message is incorrect as the problem affects the local
  certificate.
  

Local fix

• Use the "-cert -validate" command proivided by the runmqakm or
  runmqckm keystore management utilities, specifying the
  appropriate keystore and certificate label, to check the local
  certificate for validation problems.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This issue affects users of TLS connectivity between two queue
  managers, or a client and queue manager, who are reviewing MQ
  error logs in response to a failure to successfully establish a
  TLS connection.
  
  This issue does not affect Java/JMS clients, or managed .NET as
  alternate cryptographic routines are used in these cases.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  During the TLS handshake, the local certificate (if configured)
  is validated before being sent to the remote partner. If this
  validation check failed, then the AMQ9654 error message is
  written to the error log. However, the text of this message
  states the faulty certificate had been sent by the remote
  partner, and so is incorrect in this particular scenario.
  

Problem conclusion

• A new error message, AMQ9797, is added which states that the TLS
  connection failed to start due to an error validating the local
  certificate, and is issued as appropriate. AMQ9654 continues to
  be reported when the invalid certificate was received from the
  remote partner.
  
  The AMQ9797 message may be issued at the queue manager side when
  starting an inbound channel using an invalid certificate, or at
  the queue manager or client when starting an outbound channel
  using an invalid certificate.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 LTS   9.1.0.7
  v9.2 LTS   9.2.0.2
  v9.x CD    9.2.2
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels