Can you use the same certificate for two MQ Qmgrs running in different servers? I know if you have the qmgrs in the same server you can use the same cert, but when you have two servers the CN(common name)of the certificate is the hostname, so it would be different for both and i am not sure if both of them can share the same cert.
2 Answers
The IBM MQ product only checks the DN value of the peer queue manager cert against the SSLPEER configured on the channel. MQ unlike browsers (and other software such as LDAP libraries) does zero validation of the DN (or SAN) against the hostname of the remote host.
There is no technical reason the same cert could not be used on two servers, this is very common when you have HA and DR configurations.
I would consider it best practice to have unique certs for each queue manager since these are used to prove identity.
Security implications for using the same certificate on two separate queue managers:
- You have to copy the private key somehow between the two machines.
- There are now two places an attacker could gain the single Certificate.
- You can't rely on the SSLPEER feature on the client to ensure you connect to one specific QM but you could still ensure you have connected to a QM hosting that cert.
- You can't rely on the SSLPEER feature on the connecting queue manager (SDR channel for example) to ensure you connect to one specific QM but you could still ensure you have connected to a QM hosting that cert.
No, client should reject connection as untrusted. Client connects to particular server and CN in certificate, which server sends back to client, must be the same as is server name. You can use SAN (Subject alternative name) to put there more FQDN or wildcard (*) in CN.
If client connects to MQserver1:1414, servers certficate must have MQserver1 in CN or in SAN of certificate
Related