IBM After upgrading to 7.0.1.0 you get SSL error AMQ9716 - United States AMQ9716 7.0.1.0 SSL OCSP SSL TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You upgrade to WebSphere MQ 7.0.1.0 (or later) and have SSL enabled channels. After the upgrade you notice that in the Queue Manager error LOGs you see the following error message:

AMQ9716: Remote SSL certificate revocation status check failed for channel '????'. 
The channel does not start. 

SYMPTOM
Error AMQ9716


CAUSE
With the release of WebSphere MQ V7.0.1.0 the use of OCSP certificate revocation checking was included. With this new feature, most likely your SSL certificates have a OCSP AuthorityInfoAccess (AIA) certificate extension embedded inside them. 


This was ignored before V7.0.1.0. Now it is being used to verify the certificate. The most likely cause of the failure is that the system can not access the servers listed in the AIA. This then returns a UNKNOWN status when the check is done. The default action for MQ is to not allow the channel to start and the AMQ9716 to be reported when the UNKNOWN is returned.


RESOLVING THE PROBLEM
The best thing to do in this case is to determine the cause of the UNKNOWN return code and fix it. 


There are two possible methods to discover which OCSP AuthorityInfoAccess URL is embedded in a certificate. 

Method 1.
Place the certificate on a Windows machine; ensure to use a file extension of "crt" and double-click it. View the detail extensions for the AIA. 

[/support/docview.wss?uid=swg21399255&amp;aid=1]

Method 2
Use IBM Key Management (gskit) GUI to view them. Issue the following command::
In Windows: strmqikm 
In UNIX: gsk7ikm (MQ V7) or runmqckm (MQ V8)

From the IBM Key Management window:
Select View/Edit for certificate
View Details
Extensions
AuthorityInfoAccess

[/support/docview.wss?uid=swg21399255&amp;aid=2]

The first step would be to insure that connection to the URL in your certificate can be reached.


Work-around:
Use this only as a temporary fix until the root cause can be found.
You can do the following. It will still do OCSP checking and if REVOKED is returned then the channel will not start. A GOOD return code will allow the channel to start. If UNKNOWN is returned it will not stop the channel from starting and the AMQ9716 will not be reported.

UNIX and Linux systems add the following to qm.ini
SSL:
OCSPAuthentication=OPTIONAL

To set for a Windows Queue Manager, run the following command:
amqmdain reg YourQMgrName -c add -s SSL -v OCSPAuthentication=OPTIONAL

The OCSPAuthentication setting is also applicable to clients and can also be set in the client ini file (e.g. mqclient.ini). Changes to the client OCSPAuthentication setting will take effect after the application is restarted.

On a queue manager, users will need to issue a REFRESH SECURITY TYPE(SSL) command (or the GUI/PCF equivalent) in order for the change in SSL settings to take effect.

OCSP provides your SSL channels with additional security. Once the cause of the AMQ9716 error has been addressed then you are strongly recommended to re-enable OCSP enforcement

RELATED INFORMATION
 OCSP Info [http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.1.0/com.ibm.mq.doc/sy13000_.htm?lang=en]


 

PRODUCT ALIAS/SYNONYM
 WMQ MQ

Question: Getting Delay or AMQ9716: Remote SSL certificate revocation status check failed  when trying to start a MQ SSL channel, why? Getting Delay or AMQ9716: Remote SSL certificate revocation status check failed when trying to start a MQ SSL channel, please help resolve this? The error can occur on the MQ server or also a MQ client application..

AMQ9716: Remote SSL certificate revocation status check failed

Remote SSL certificate revocation status check failed for channel '???'.

EXPLANATION: WebSphere MQ failed to determine the revocation status of the remote SSL
certificate for one of the following reasons:

(a) The channel was unable to contact any of the CRL servers or OCSP responders for the certificate.
(b) None of the OCSP responders contacted knows the revocation status of the certificate.
(c) An OCSP response was received, but the digital signature of the response could not be verified.

Answer: With the release of WebSphere MQ V7.0.1.0 the use of OCSP certificate revocation checking was included. With this new feature, most likely your SSL certificates have a OCSP AuthorityInfoAccess (AIA) certificate extension embedded inside them. 


This was ignored before V7.0.1.0. Now it is being used to verify the certificate. The most likely cause of the failure is that the system can not access the servers listed in the AIA. This then returns a UNKNOWN status when the check is done. The default action for MQ is to not allow the channel to start and the AMQ9716 to be reported when the UNKNOWN is returned.