title: IBM MQ expects username and password when using SSL certificates (Error 2035)
body: <p>I am stuck at using SSL in IBM Websphere MQ (9.2).
  I am building a client library for MQ and to get more familiar with MQ on the server side I have installed <code>IBM MQ Developer edition</code> and ran the supplied scripts to create a 'default' MQ server instance.</p>
  <ol>
  <li>Created an client connection for the <code>DEV.APP.SVRCONN</code> server connection</li>
  <li>Created a <em>personal certificate</em> by using the IBM Key management tool and named it <code>ibmwebspheremq</code></li>
  <li>Enabled SSL on the <em>Queue Manager</em> (QM1) and labelled it <code>ibmwebspheremq</code></li>
  <li>Updated the SSL configuration for the <code>DEV.APP.SVRCONN</code> channel and set the <code>cipherspec</code> property to <code>TLS 1.2, 256-bit Secure Hash Algorithm, 128-bit AES encryption (TLS_RSA_WITH_AES_128_CBC_SHA256)</code> and made SSL required.</li>
  </ol>
  <p>Tested my settings with:</p>
  <pre><code>amqssslc -l ibmwebspheremq -k C:\ProgramData\IBM\MQ\qmgrs\QM1\ssl\key  -c DEV.APP.SVRCONN -x 127.0.0.1 -s TLS_RSA_WITH_AES_128_CBC_SHA256 -m QM1
  </code></pre>
  <p>And that gave me:</p>
  <pre><code>Sample AMQSSSLC start
  Connecting to queue manager QM1
  Using the server connection channel DEV.APP.SVRCONN
  on connection name 127.0.0.1.
  Using SSL CipherSpec TLS_RSA_WITH_AES_128_CBC_SHA256
  Using SSL key repository stem C:\ProgramData\IBM\MQ\qmgrs\QM1\ssl\key
  Certificate Label: ibmwebspheremq
  No OCSP configuration specified.
  MQCONNX ended with reason code 2035
  </code></pre>
  <p>Error details (from log):</p>
  <pre><code>The active values of the channel were 'MCAUSER(app) CLNTUSER(Wilko)
  SSLPEER(SERIALNUMBER=61:9B:A4:3E,CN=DESKTOP-ROH98N2,C=NL)
  SSLCERTI(CN=DESKTOP-ROH98N2,C=NL) ADDRESS(DESKTOP-ROH98N2)'. The
  MATCH(RUNCHECK) mode of the DISPLAY CHLAUTH MQSC command can be used to
  identify the relevant CHLAUTH record.
  ACTION:
  Ensure that the application provides a valid user ID and password, or change
  the queue manager connection authority (CONNAUTH) configuration to OPTIONAL to
  allow client applications to connect which have not supplied a user ID and
  password. 
  ----- cmqxrmsa.c : 2086 -------------------------------------------------------
  22/11/2021 15:51:37 - Process(15880.45) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                        Host(DESKTOP-ROH98N2) Installation(Installation1)
                        VRMF(9.2.3.0) QMgr(QM1)
                        Time(2021-11-22T14:51:37.594Z)
                        CommentInsert1(DEV.APP.SVRCONN)
                        CommentInsert2(15880(1112))
                        CommentInsert3(127.0.0.1)
                       
  AMQ9999E: Channel 'DEV.APP.SVRCONN' to host '127.0.0.1' ended abnormally.
  
  EXPLANATION:
  The channel program running under process ID 15880(1112) for channel
  'DEV.APP.SVRCONN' ended abnormally. The host name is '127.0.0.1'; in some cases
  the host name cannot be determined and so is shown as '????'.
  ACTION:
  Look at previous error messages for the channel program in the error logs to
  determine the cause of the failure. Note that this message can be excluded
  completely or suppressed by tuning the &quot;ExcludeMessage&quot; or &quot;SuppressMessage&quot;
  attributes under the &quot;QMErrorLog&quot; stanza in qm.ini. Further information can be
  found in the System Administration Guide. 
  ----- amqrmrsa.c : 630 --------------------------------------------------------
  </code></pre>
  <p>I am kind of stuck, I also saw in the log that there is PEER related info dumped, but I am not sing the SSLPEER settings (I just want to let everyone connect with the same certificate).</p>
  <p>EDIT 2:</p>
  <p>Output from <code>RUNMQSC QM1</code> and command <code>DISPLAY QMGR CONNAUTH</code>:</p>
  <pre><code>     1 : DISPLAY QMGR CONNAUTH
  AMQ8408I: Display Queue Manager details.
     QMNAME(QM1)                             CONNAUTH(DEV.AUTHINFO)
  </code></pre>
  <p>Output from <code>RUNMQSC QM1</code> and command <code>DISPLAY AUTHINFO(name-from-previous-command)</code>:</p>
  <pre><code>     3 : DISPLAY AUTHINFO(DEV.AUTHINFO)
  AMQ8566I: Display authentication information details.
     AUTHINFO(DEV.AUTHINFO)                  AUTHTYPE(IDPWOS)
     ADOPTCTX(YES)                           DESCR( )
     CHCKCLNT(REQDADM)                       CHCKLOCL(OPTIONAL)
     FAILDLAY(1)                             AUTHENMD(OS)
     ALTDATE(2021-11-18)                     ALTTIME(15.09.20)
  </code></pre>
  <p>Output from <code>DISPLAY CHLAUTH(*)</code>:</p>
  <pre><code>     4 : DISPLAY CHLAUTH(*)
  AMQ8878I: Display channel authentication record details.
     CHLAUTH(DEV.ADMIN.SVRCONN)              TYPE(USERMAP)
     CLNTUSER(admin)                         USERSRC(CHANNEL)
  AMQ8878I: Display channel authentication record details.
     CHLAUTH(DEV.ADMIN.SVRCONN)              TYPE(BLOCKUSER)
     USERLIST(nobody)
  AMQ8878I: Display channel authentication record details.
     CHLAUTH(DEV.APP.SVRCONN)                TYPE(ADDRESSMAP)
     ADDRESS(*)                              USERSRC(CHANNEL)
     CHCKCLNT(REQUIRED)
  AMQ8878I: Display channel authentication record details.
     CHLAUTH(SYSTEM.ADMIN.SVRCONN)           TYPE(ADDRESSMAP)
     ADDRESS(*)                              USERSRC(CHANNEL)
  AMQ8878I: Display channel authentication record details.
     CHLAUTH(SYSTEM.*)                       TYPE(ADDRESSMAP)
     ADDRESS(*)                              USERSRC(NOACCESS)
  </code></pre>
  <p>I was expecting not having to provide username and password when using certificates. What am I missing here?</p>