Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Venkata Suman Palukuru (VenkataSumanP5754)
WellsFargo
Pega Principal Architect
WellsFargo
IN
VenkataSumanP5754 Member since 2021 65 posts
WellsFargo
Posted: Nov 8, 2017
Last activity: Dec 4, 2017
Posted: 8 Nov 2017 13:20 EST
Last activity: 4 Dec 2017 12:38 EST
Closed
Solved

Connect - MQ support with Certificates and Chipher suites

My application is using Pega 7.1.6 version and we have requirement to connect to MQ passing the certificates ( SSL/TLS) and use the chipersuites while sending the message to MQ. I see we have an option in Pega 7.2.2 MQ Server rule form to mention the Cipher suites and Key/Trust store.

How do we achieve in the versions less than Pega 7.2.2. When I looked into some forums , it says we need to configure at app server level. Below is the PDN link for you reference.Our app server is IBM web sphere

https://pdn.pega.com/community/pega-product-support/question/mq-ssl

Appreciate if you can mention detailed steps on how this has to be configured at app server level and any other alternate solutions will also be greatly helpful.

-- Suman

***Moderator Edit: Vidyaranjan | Updated SR details***

***Edited by Moderator Marissa to update categories***

To see attachments, please log in.
Data Integration
Security
System Administration
Installation and Deployment
Updates
Support Case Exists

Accepted Solution

Posted: 7 years ago
Posted: 16 Nov 2017 23:06 EST
Eugene Roytfeld (EugeneR7)
Deutsche Bank
Vice President
Deutsche Bank
US

We recently had the same requirement with Pega 7.1.8.  To summarize, what Sudhakar mentioned is the correct approach, however, if you want to make sure that Pega's MQ features work in all cases, you will have to modify all MQ related activities with the same change (specifically MQEnvironment.sslCipherSuite = "<Cipher Suite>"';).  Activities which are used to browse messages, put, test, etc...  Here's a full list:

Rule-Connect-MQ Rule-Obj-Activity RemoveMQMessage 
Rule-Connect-MQ Rule-Obj-Activity BrowseMQServerMessages 
Rule-Connect-MQ Rule-Obj-Activity AddMQMessage 
Rule-Connect-MQ Rule-Obj-Activity GenericViewMQMessages 
Rule-Connect-MQ Rule-Obj-Activity GetContextList 
Rule-Connect-MQ Rule-Obj-Activity InvokeMQConnector 
Data-Admin-Connect-MQServer Rule-Obj-Activity ValidateInfrastructureMQ 
Rule-Connect-MQ Rule-Obj-Activity ValidateInfrastructureConnectMQ 
Data-Admin-Connect-MQListener Rule-Obj-Activity ValidateInfrastructureMQListener

Additionally, if you want to NOT hardcode the cipher, you can customize the MQServer ruleform and add your own properties.  Note that if you choose to do it this way, you will enable support of multiple ciphers for different MQ servers.  It may or may not be relevant in your case.

Show More

We recently had the same requirement with Pega 7.1.8.  To summarize, what Sudhakar mentioned is the correct approach, however, if you want to make sure that Pega's MQ features work in all cases, you will have to modify all MQ related activities with the same change (specifically MQEnvironment.sslCipherSuite = "<Cipher Suite>"';).  Activities which are used to browse messages, put, test, etc...  Here's a full list:

Rule-Connect-MQ Rule-Obj-Activity RemoveMQMessage 
Rule-Connect-MQ Rule-Obj-Activity BrowseMQServerMessages 
Rule-Connect-MQ Rule-Obj-Activity AddMQMessage 
Rule-Connect-MQ Rule-Obj-Activity GenericViewMQMessages 
Rule-Connect-MQ Rule-Obj-Activity GetContextList 
Rule-Connect-MQ Rule-Obj-Activity InvokeMQConnector 
Data-Admin-Connect-MQServer Rule-Obj-Activity ValidateInfrastructureMQ 
Rule-Connect-MQ Rule-Obj-Activity ValidateInfrastructureConnectMQ 
Data-Admin-Connect-MQListener Rule-Obj-Activity ValidateInfrastructureMQListener

Additionally, if you want to NOT hardcode the cipher, you can customize the MQServer ruleform and add your own properties.  Note that if you choose to do it this way, you will enable support of multiple ciphers for different MQ servers.  It may or may not be relevant in your case.

Data-Admin-Connect-MQServer Rule-HTML-Section pzEnvironmentInner 
Data-Admin-Connect-MQServer Rule-HTML-Section SecuritySettings 
 

Finally, if you need to actually READ from MQ queue, then you need to request HFIX-38202 (for 7.1.8) or have it backported.  This one specifically addresses a java MQListener class to support sslciphersuite (configured via DSS).  Otherwise you will need to test MQ connection via MQ Server / Listener instance before starting listeners (still a mystery why this actually works).

Depending on which IBM MQ Server version you are using, you may need to add 2 JVM params for Pega :

-Dcom.ibm.mq.cfg.useIBMCipherMappings=false
-Dcom.ibm.mq.cfg.preferTLS=true


Show Less
To see attachments, please log in.
Posted: 7 years ago
Posted: 10 Nov 2017 1:08 EST
Sudhakar Reddy Yaparla (YSudhakarReddy)
JPMorgan Chase & Company

JPMorgan Chase & Company
US

Hi,

Customize the ValidateInfrastructureMQ activity(Step 2) and invokeMQConnector to explicitly use the SSL properties needed for the higher encryption for use in the MQEnvironment class.
            MQEnvironment.hostname = hostname;
            MQEnvironment.channel = channel;
            MQEnvironment.port = port;
            MQEnvironment.sslFipsRequired=false;  
            MQEnvironment.sslCipherSuite = "<Cipher Suite>";

To see attachments, please log in.
Posted: 7 years ago
Posted: 10 Nov 2017 11:17 EST
Venkata Suman Palukuru (VenkataSumanP5754)
WellsFargo
Pega Principal Architect
WellsFargo
IN

Thanks for the reply Sudhkar. Couple of queries

1) I understood sslFipsRequired is a flag which will enable the MQ Queue Manger to use a SSL connection with Cipher Suite , but how can I mention the truststore or keystore name. Pega 7.2.2 has the option to mention the Keystore and truststore references

2) Regarding the cipher suite , do I need to install any jar files for Pega 7.1.6 application on Pega side?

3) Do we  also need to mention the CipherSpec in the code as well?

I am not IBM websphere expert , so I trying to understand more details.

-- Suman

To see attachments, please log in.

Accepted Solution

Posted: 7 years ago
Posted: 16 Nov 2017 23:06 EST
Eugene Roytfeld (EugeneR7)
Deutsche Bank
Vice President
Deutsche Bank
US

We recently had the same requirement with Pega 7.1.8.  To summarize, what Sudhakar mentioned is the correct approach, however, if you want to make sure that Pega's MQ features work in all cases, you will have to modify all MQ related activities with the same change (specifically MQEnvironment.sslCipherSuite = "<Cipher Suite>"';).  Activities which are used to browse messages, put, test, etc...  Here's a full list:

Rule-Connect-MQ Rule-Obj-Activity RemoveMQMessage 
Rule-Connect-MQ Rule-Obj-Activity BrowseMQServerMessages 
Rule-Connect-MQ Rule-Obj-Activity AddMQMessage 
Rule-Connect-MQ Rule-Obj-Activity GenericViewMQMessages 
Rule-Connect-MQ Rule-Obj-Activity GetContextList 
Rule-Connect-MQ Rule-Obj-Activity InvokeMQConnector 
Data-Admin-Connect-MQServer Rule-Obj-Activity ValidateInfrastructureMQ 
Rule-Connect-MQ Rule-Obj-Activity ValidateInfrastructureConnectMQ 
Data-Admin-Connect-MQListener Rule-Obj-Activity ValidateInfrastructureMQListener

Additionally, if you want to NOT hardcode the cipher, you can customize the MQServer ruleform and add your own properties.  Note that if you choose to do it this way, you will enable support of multiple ciphers for different MQ servers.  It may or may not be relevant in your case.

Show More

We recently had the same requirement with Pega 7.1.8.  To summarize, what Sudhakar mentioned is the correct approach, however, if you want to make sure that Pega's MQ features work in all cases, you will have to modify all MQ related activities with the same change (specifically MQEnvironment.sslCipherSuite = "<Cipher Suite>"';).  Activities which are used to browse messages, put, test, etc...  Here's a full list:

Rule-Connect-MQ Rule-Obj-Activity RemoveMQMessage 
Rule-Connect-MQ Rule-Obj-Activity BrowseMQServerMessages 
Rule-Connect-MQ Rule-Obj-Activity AddMQMessage 
Rule-Connect-MQ Rule-Obj-Activity GenericViewMQMessages 
Rule-Connect-MQ Rule-Obj-Activity GetContextList 
Rule-Connect-MQ Rule-Obj-Activity InvokeMQConnector 
Data-Admin-Connect-MQServer Rule-Obj-Activity ValidateInfrastructureMQ 
Rule-Connect-MQ Rule-Obj-Activity ValidateInfrastructureConnectMQ 
Data-Admin-Connect-MQListener Rule-Obj-Activity ValidateInfrastructureMQListener

Additionally, if you want to NOT hardcode the cipher, you can customize the MQServer ruleform and add your own properties.  Note that if you choose to do it this way, you will enable support of multiple ciphers for different MQ servers.  It may or may not be relevant in your case.

Data-Admin-Connect-MQServer Rule-HTML-Section pzEnvironmentInner 
Data-Admin-Connect-MQServer Rule-HTML-Section SecuritySettings 
 

Finally, if you need to actually READ from MQ queue, then you need to request HFIX-38202 (for 7.1.8) or have it backported.  This one specifically addresses a java MQListener class to support sslciphersuite (configured via DSS).  Otherwise you will need to test MQ connection via MQ Server / Listener instance before starting listeners (still a mystery why this actually works).

Depending on which IBM MQ Server version you are using, you may need to add 2 JVM params for Pega :

-Dcom.ibm.mq.cfg.useIBMCipherMappings=false
-Dcom.ibm.mq.cfg.preferTLS=true


Show Less
To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice