无法使用 .NET 标准库通过 TLS 连接到 IBM MQ

Question

我们在尝试使用 .net 标准 nuget 包 IBMMQDotnetClient 通过 TLS ({"MQRC_HOST_NOT_AVAILABLE"}) 连接到 IBM MQ 时遇到异常。该项目使用 .net 框架 4.7.2。我们可以在不使用 SSL 的情况下进行连接，而且当我们切换到 .net 框架 nuget 包 WebSphereMQClient 时，我们可以使用完全相同的代码和设置进行连接（只需换出 nuget 库就可以使其工作） )。

此外，我无法为 .net 标准库启用跟踪。文档表明需要设置环境变量 MQDOTNET_TRACE_ON，但即使在那之后我也没有生成任何东西。我尝试添加其他变量，例如 MQERRORPATH，但仍然没有看到任何跟踪文件。

代码

var queueManagerName = "QM1";
var hostName = "hostname.com";
var channel = "DEV.APP.SVRCONN";
var queueName = "DEV.QUEUE.1";
var port = "1414";

var sslKeyRepository = "*USER";
var cipherSpec = "TLS_RSA_WITH_AES_256_CBC_SHA256";

Hashtable prop = new Hashtable();

prop.Add(MQC.HOST_NAME_PROPERTY, hostName);
prop.Add(MQC.PORT_PROPERTY, port);
prop.Add(MQC.CHANNEL_PROPERTY, channel);
prop.Add(MQC.CONNECT_OPTIONS_PROPERTY, MQC.MQCNO_RECONNECT);
prop.Add(MQC.TRANSPORT_PROPERTY, MQC.TRANSPORT_MQSERIES_MANAGED);

prop.Add(MQC.SSL_CERT_STORE_PROPERTY, sslKeyRepository);

prop.Add(MQC.SSL_CIPHER_SPEC_PROPERTY, cipherSpec);
            
try { 
    var queueManager = new MQQueueManager(queueManagerName, prop);
    MQQueue _queue = queueManager.AccessQueue(queueName, MQC.MQOO_INPUT_AS_Q_DEF + MQC.MQOO_FAIL_IF_QUIESCING);

}
catch (Exception ex)
{
    Console.WriteLine(ex.Message);
}

来自客户端 AMKERR01.LOG 的错误：

7/16/2021 7:16:12 PM - Process(15212.1) User(Eric.Kaufman) Program(ConsoleApp1)
                       Host(DLW011309) Installation(Unknown)
                       VRMF(9.2.2.0)
                       Time(2021-07-16T23:16:12.121Z)
                       ArithInsert1(0) ArithInsert2(0)
                       CommentInsert1(hostname.com(1414))
                       CommentInsert2(TCP/IP)
                       CommentInsert3( (Exception))
                      
AMQ9202E: Remote host not available, retry later.

EXPLANATION:
The attempt to allocate a conversation using TCP/IP to host
'hostname.com(1414)' for channel 
(Exception) was not successful. However the error may be a transitory one and
it may be possible to successfully allocate a TCP/IP conversation later. 

In some cases the remote host cannot be determined and so is shown as '????'.
ACTION:
Try the connection again later. If the failure persists, record the error
values and contact your systems administrator. The return code from TCP/IP is 0
(X'0'). The reason for the failure may be that this host cannot reach the
destination host. It may also be possible that the listening program at host
'hostname.com(1414)' was not running.  If
this is the case, perform the relevant operations to start the TCP/IP listening
program, and try again.

来自队列管理器日志的错误

07/16/21 23:16:12 - Process(401.18) User(mqm) Program(amqrmppa)
                    Host(a55a7574679b) Installation(Installation1)
                    VRMF(9.2.2.0) QMgr(QM1)
                    Time(2021-07-16T23:16:12.102Z)
                    RemoteHost(XXX.XXX.XXX.XXX)
                    ArithInsert1(420)
                    CommentInsert1(????)
                    CommentInsert2(gsk_secure_soc_read)
                    CommentInsert3(XXX.XXX.XXX.XXX)

AMQ9665E: SSL connection closed by remote end of channel '????'.

EXPLANATION:
The SSL or TLS connection was closed by the remote host 'XXX.XXX.XXX.XXX'
during the secure socket handshake. The channel is '????'; in some cases its
name cannot be determined and so is shown as '????'. The channel did not start.
ACTION:
Check the remote end of the channel for SSL and TLS errors. Fix them and
restart the channel.
----- amqccisa.c : 11155 ------------------------------------------------------
07/16/21 23:16:12 - Process(401.18) User(mqm) Program(amqrmppa)
                    Host(XXXXXXXXX) Installation(Installation1)
                    VRMF(9.2.2.0) QMgr(QM1)
                    Time(2021-07-16T23:16:12.103Z)
                    CommentInsert1(????)
                    CommentInsert2(401)
                    CommentInsert3(XXX.XXX.XXX.XXX)

AMQ9999E: Channel '????' to host 'XXX.XXX.XXX.XXX' ended abnormally.

EXPLANATION:
The channel program running under process ID 401 for channel '????' ended
abnormally. The host name is 'XXX.XXX.XXX.XXX'; in some cases the host name
cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.

Answer 1

这最终是我的用户错误，但我会包括我的步骤，以防它最终对其他人有所帮助。启用跟踪的环境变量确实有效，但需要重新启动 Visual Studio 才能生效。我最终使用的三个是：

MQDOTNET_TRACE_ON = "2",
MQERRORPATH = "C:\MQERRORLOGPATH",
MQTRACEPATH = "C:\MQTRACEPATH"

生成跟踪文件后，我发现了这个异常：

System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

这是因为我使用的是自签名证书。将证书添加到 Windows 证书管理器中的受信任的根证书颁发机构文件夹后，我能够成功连接。