The queue manager initiating the connection always validates the cert presented by the other queue manager as long as the SSLCIPH
attribute is populated. The cert presented must be trusted and not expired.
On the receiving queue manager the sending queue manager cert is always validated if present. Having SSLCAUTH(REQUIRED)
and/or a value specified in the SSLPEER
mandate that the sending queue manager MUST have a certificate.
In a TLS session the initiator is the TLS client. A MQ sender channel is always the TLS client. The SSLCAUTH
attribute stands for SSL Client Auth, by setting this to REQUIRED
you tell the receiver that the sender must have a cert. Having a SSLPEER
in the receiver also behaves the same in that it requires the sender to have a cert.