In MQ we have sender channel and receiver channel.
Communication is started by sender channel and only receiver channel has SSLCAUTH attribute
So does certificate of RECEIVER channel MQ is validated by SENDER side or only certificate of SENDER channel MQ is validated by RECEIVER side?
The queue manager initiating the connection always validates the cert presented by the other queue manager as long as the SSLCIPH attribute is populated. The cert presented must be trusted and not expired.
On the receiving queue manager the sending queue manager cert is always validated if present. Having SSLCAUTH(REQUIRED) and/or a value specified in the SSLPEER mandate that the sending queue manager MUST have a certificate.
In a TLS session the initiator is the TLS client. A MQ sender channel is always the TLS client. The SSLCAUTH attribute stands for SSL Client Auth, by setting this to REQUIRED you tell the receiver that the sender must have a cert. Having a SSLPEER in the receiver also behaves the same in that it requires the sender to have a cert.
