IBM DataPower - IBM MQ v9 QueueManager Object - properties for mqclient.ini of dpSideCarMQProc

The checking of OCSP and CRL in dpSideCarMQProc for MQv9 objects is set to "required" by default.

In deprecated MQ (v8) objects the checks are not required by default and hence don't cause continuous errors for failed connection to OCSP and CRL.

We need the following properties to be persistently configurable in mqclient.ini for dpSideCarMQProc (per CLI command or in WebGUI) to be able to set both checks to optional if neccessary.

SSL:
  OCSPAuthentication=OPTIONAL
  ClientRevocationChecks=OPTIONAL

The "validation credential" for TLS Server/Client Profile has the option to use the CRL and set them to require or optional.
This option will not be considered by dpSideCarMQProc for TLS handshake.

Reasons why we need to set the checks to "optional" or "turn it off" in several scenarios:

- DataPower instances are positioned in different network zones (low level of security right up to high level security)
- Endpoint of OCSP and CRL is in positioned in high level security zone
- connections from low level security to high level security zone are not allowed (firewall exceptions are only allowed for very limited time frame / one-time operations)
- an universal firewall rule for access to OCSP and CRL from all network zones is not allowed and defined in concept of security for infrastructure
- the extension for CRL and OCSP are required in certificates by BSI (Bundesamt fuer Sicherheit in der Informationstechnik) and defined in TR-02103 [https://www.bsi.bund.de/dok/TR-02103] (section 2.3.5 CRL Distribution Points and 2.3.9 Authority Information Access) and could not be exclude at creation of certificate
- it seems there is no TLS session handling / reuse to reduce the handshake for new connections
- there is no caching of fetched information to reduce the check-requests to both endpoints
- we expect a huge traffic overhead at both endpoints because the checks of server certificate and issuer CA will be processed for each connection to queue manager (e.g. a tcp trace shows 4 connections to OCSP endpoint (2 for intermediate and root ca) for a single put/get operation cycle to request-/reply-queue)
- there would be downtimes of a large number of services if the OSCP/CRL lists should become unavailable due to network errors/maintenance etc.

We'd prefer the option to turn off the checks for known certificate authorities (CA) like in validation credential for tls profile.