2

I have a C# Web service which is running under IIS 7.5 on Windows Server 2008 R2 using the DefaultAppPool user as the application identity (IIS APPPOOL\DefaultAppPool). The Web service uses IBM Websphere MQ (7.0.1.2) to do it's stuff and uses the SSL certificates stored in a key.kdb setup via IBMs KeyMan utility.

Normally (for C# apps that are not running IIS) I need to label the personal certificate within the kdb so that it's name matches the user that is running the app i.e. the certificate would be labelled as ibmwebspheremqbs6mjb (see http://www-01.ibm.com/support/docview.wss?uid=swg21245474) and this allows the app to successfully access the SSL certificates within the key.kdb.

But..... when running as a Web service and naming the certificate ibmwebspheremqdefaultapppool the application cannot access the SSL certs. If I change the AppPool identity to be bs6mjb then everything works (I'm not allowed to run the app pool as bs6mjb).

I'd prefer not to setup a default certificate as mentioned in the link above, does anyone know what the certificate should be labelled as to work with DefaultAppPool?

Mark Byers
  • 811,555
  • 193
  • 1,581
  • 1,452
bs6mjb
  • 23
  • 3
  • Can you describe the error you are getting when using 'ibmwebspheremqdefaultapppool'? – Shashi Jul 13 '12 at 08:17
  • The web service fails to connect and gives an MQRC_SSL_INITIALIZATION_ERROR, not in front of my machine at the moment but from memory it was a 2393 error – bs6mjb Jul 16 '12 at 20:31

1 Answers1

0

For MQ clients the certificate label must have the user name who runs the client. In your case, for example ibmwebspheremqbs6mjb. If the certificate label is something else, the MQ client (actually GSKit libraries) will not find the certificate to connect to queue manager. I think that's what is happening when you have the label as ibmwebspheremqdefaultapppool.

This blog has interesting and useful details. You may want to check under what user IIS runs and create a certificate for that user and do the required SSL setup between client and MQ queue manager.

Shashi
  • 14,980
  • 2
  • 33
  • 52
  • So... it wasn't defaultapppool that I needed - my default app pool was actually running as ASP.NET v4.0 so I needed to name the certificate "ibmwebspheremqasp.net v4.0" (note the space!) – bs6mjb May 09 '13 at 10:02