Sun Java System Message Queue 3.7 UR1 Administration Guide

Using Self-Signed Certificates


For a stronger level of authentication, you can use signed certificates verified by a certification authority. The use of signed certificates involves some additional steps beyond those needed for self-signed certificates: you must first perform the steps described in this section and then follow them with the additional ones in Using Signed Certificates.

Message Queue's support for SSL with self-signed certificates is oriented toward securing on-the-wire data, on the assumption that the client is communicating with a known and trusted server. The following procedure shows the steps needed to set up an SSL-based connection service to use self-signed certificates. The subsections that follow describe each of these steps in greater detail.

ProcedureTo Set Up an SSL-Based Connection Service Using Self-Signed Certificates

  1. Generate a self-signed certificate.

  2. Enable the ssljms, ssladmin, or cluster connection service in the broker.

  3. Start the broker.

  4. Configure and run the client.

    This step applies only to the ssljms connection service and not to ssladmin or cluster.

Generating a Self-Signed Certificate

Run the Key Tool utility (imqkeytool) to generate a self-signed certificate for the broker. (On UNIX® systems, you may need to run the utility as the superuser (root) in order to have permission to create the key store.) The same certificate can be used for the ssljms, ssladmin, or cluster connection service.

Enter the following at the command prompt:

imqkeytool -broker

The Key Tool utility prompts you for a key store password:

   Generating keystore for the broker ...
   Enter keystore password:

Next, the utility prompts you for information identifying the broker to which this certificate belongs. The information you supply will make up an X.500 distinguished name. Table 7–5 shows the prompts and the values to be provided for each. Values are case-insensitive and can include spaces.

Table 7–5 Distinguished Name Information Required for a Self-Signed Certificate


X.500 Attribute 



What is your first and last name?

commonName (CN)

Fully qualified name of server running the broker 


What is the name of your organizational unit?

organizationalUnit (OU)

Name of department or division 


What is the name of your organization?

organizationName (ON)

Name of larger organization, such as a company or government entity 

My Company, Inc.

What is the name of your city or locality?

localityName (L)

Name of city or locality 

San Francisco

What is the name of your state or province?

stateName (ST)

Full (unabbreviated) name of state or province 


What is the two-letter country code for this unit?

country (C)

Standard two-letter country code 


When you have entered the information, the Key Tool utility displays it for confirmation. For example:

   Is CN=mqserver.sun.com, OU=purchasing, ON=My Company, Inc.,

To accept the current values and proceed, enter yes; to reenter values, accept the default or enter no. After you confirm, the utility pauses while it generates a key pair.

Next, the utility asks for a password to lock the key pair (key password). Press Return in response to this prompt to use the same password as the key password and key store password.

Note –

Remember the password you specify. You must provide this password when you start the broker, to allow the broker to open the key store. You can store the key store password in a password file (see Password Files).

The Key Tool utility generates a self-signed certificate and places it in Message Queue’s key store. The key store is located in a directory that depends upon the operating system, as shown in Appendix A, Platform-Specific Locations of Message QueueTM Data.

The following are the configurable properties for the Message Queue key store for SSL-based connection services:


java.security.UnrecoverableKeyException: Cannot recover key

(This exception may result if you provided a key password different from the key store password when you generated the self-signed certificate.)

ProcedureTo Regenerate a Key Pair

  1. Remove the broker’s key store, located as shown in Appendix A, Platform-Specific Locations of Message QueueTM Data.

  2. Run imqkeytool again to generate a new key pair, as described above.

Enabling an SSL-Based Connection Service

To enable an SSL-based connection service in the broker, you need to add ssljms (or ssladmin) to the imq.service.activelist property.

ProcedureTo Enable an SSL-Based Service in the Broker

  1. Open the broker’s instance configuration file.





    Note –

    The SSL-based cluster connection service is enabled using the imq.cluster.transport property rather than the imq.service.activelist property; see Connecting Brokers.

  3. Save and close the instance configuration file.

Starting the Broker

Start the broker, providing the key store password. You can provide the password in either of two ways:

Note –


Configuring and Running an SSL-Based Client


Application Clients


If you are using a version of the Java 2 Software Development Kit (J2SDK) earlier than 1.4, you must also include the following Java Secure Socket Extension (JSSE) and Java Naming and Directory Interface (JNDI) .jar files:

(It is not necessary to include these files if you are using J2SDK 1.4 or later, which has JSSE and JNDI support built in.)


java -DimqConnectionType=TLS clientAppName


Administrative Clients


imqcmd list svc -b hostName:portNumber -u adminName -secure

where adminName is a valid entry in the Message Queue user repository. The command will prompt you for the password. (If you are using a flat-file repository, see Changing the Default Administrator Password).


Listing all the services on the broker specified by:

Host                 Primary Port
localhost            7676

Service Name     Port Number       Service State
admin            33984 (dynamic)   RUNNING
httpjms          -                 UNKNOWN
httpsjms         -                 UNKNOWN
jms              33983 (dynamic)   RUNNING
ssladmin         35988 (dynamic)   RUNNING
ssljms           dynamic           UNKNOWN

Successfully listed services.