IBM MQ 7.5 was EOS 30th April 2018. Click EOS notice for more details

Security reference

Use the reference information in this section to help you configure security for IBM® WebSphere® MQ.

The API exit
An API exit is a program module that monitors or modifies the function of MQI calls. An API exit comprises multiple API exit functions, each with its own entry point in the module.
The API-crossing exit
An API-crossing exit is a program that monitors or modifies the function of MQI calls issued by CICS® applications on z/OS®.
Certificate validation and trust policy design on UNIX, Linux and Windows systems
WebSphere MQ validates SSL or TLS certificates according to two types of policy, basic, and standard. Standard policy checking conforms to RFC 5280.
Cryptographic hardware
On UNIX, Linux® and Windows systems, WebSphere MQ provides support for a variety of cryptographic hardware using the PKCS #11 interface. On IBM i and z/OS, the operating system provides the cryptographic hardware support.
IBM WebSphere MQ Telemetry rules for SSLPEER values
The SSLPEER attribute is used to check the Distinguished Name (DN) of the certificate from the peer queue manager or client at the other end of an IBM WebSphere MQ channel. IBM WebSphere MQ uses certain rules when comparing these values
GSKit: Digital certificate signature algorithms compliant with FIPS 140-2
The list of digital certificate signature algorithms in GSKit that are compliant with FIPS 140-2
GSKit return codes used in IBM WebSphere MQ AMS messages
This topic describes the IBM Global Security Kit (GSKit) return codes that appear in some IBM WebSphere MQ AMS messages.
Migrating with AltGSKit from IBM WebSphere MQ Telemetry Version 7.0.1 to Version 7.1
Perform this task only if you are migrating from IBM WebSphere MQ Telemetry Version 7.0.1 using the AltGSKit configuration setting to load an alternative GSKit. The alternative GSKit used by IBM WebSphere MQ Telemetry Version 7.0.1 with the AltGSKit setting is separate from the GSKit used by IBM WebSphere MQ Telemetry Version 7.1; changes to each GSKit do not affect the other. This is because IBM WebSphere MQ Telemetry Version 7.1 uses a private local copy of GSKit in its installation directory and does not support the use of an alternative GSKit.
CipherSpec mismatches
Both ends of a WebSphere MQ SSL channel must use the same CipherSpec. Mismatches can be detected during the SSL handshake or during channel startup.
Authentication failures
There are a number common reasons for authentication failures during the SSL handshake.

Parent topic: Reference