# Step 1: Ensuring WebSphere MQ certificate stores contain complete certificate chains

This section deals with ensuring that complete certificate chains exist in the WebSphere® MQ certificate store. This should be completed before installing WebSphere MQ Version 7.0.

WebSphere MQ Version 7.0 uses the Global Security Toolkit (GSKit) to manage SSL certificates. Before installing WebSphere MQ Version 7.0 you must ensure that all WebSphere MQ certificate stores contain complete certificate chains.

In Step 2: Migrating SSL certificates to Global Security Toolkit key database files, it gives guidance on migrating certificates used by WebSphere MQ Version 5.3 queue managers and WebSphere MQ clients into key database files for use with Global Security Toolkit.

As an alternative to Step 1: Ensuring WebSphere MQ certificate stores contain complete certificate chains and Step 2: Migrating SSL certificates to Global Security Toolkit key database files, you can manually configure a key database for each queue manager and WebSphere MQ client and import SSL certificates directly into it without migrating them. See Working with the Secure Sockets Layer (SSL) on UNIX® and Windows® systems for details of how to do this. You will still need to complete Step 3: Ensuring Certificate Revocation Lists are in the correct format and Step 4: Ensuring SSLPEER values have correctly ordered OU entries.

The following sections give the background and necessary steps for "Ensuring WebSphere MQ certificate stores contain complete certificate chains":

- SSL certificates and certificate chains
- Why you must ensure complete SSL certificate chains exist before installation
- Where to locate WebSphere MQ certificate stores
- How to check WebSphere MQ certificate stores contain complete certificate chains
- How to add missing certification authority certificates into WebSphere MQ certificate stores
- What to do if WebSphere MQ version 7.0 has already been installed

- SSL certificates and certificate chains
  This section explains what SSL certificates are, what a complete certificate chain is and why WebSphere MQ certificate stores need them.
- Why you must ensure complete SSL certificate chains exist before installation
  During the installation of WebSphere MQ Version 7.0, the AMQMCERT command line interface and the Manage SSL Certificates graphical interface, which provide access to WebSphere MQ Version 5.3 certificate stores, are removed, and you will not be able to add any missing certification authority certificates to these stores after installation.
- Where WebSphere MQ certificate stores are located
  This section gives details on where you can find the WebSphere MQ certificate stores installed on your systems.
- How to check WebSphere MQ certificate stores contain complete certificate chains
  This section details how you can check if the SSL certificate chains that exist in your SSL certificate store are complete.
- Adding missing certification authority certificates into WebSphere MQ certificate stores
  This section gives the commands necessary to add SSL certificates into WebSphere MQ certificate stores to complete the certificate chains before migrating to WebSphere MQ Version 7.0.
- If WebSphere MQ Version 7.0 has already been installed
  This section deals with the issue of having upgraded to WebSphere MQ Version 7.0 without having complete certificate chains.

Parent topic: SSL migration steps