Error while setting TLS cipher in MQ adapters

, ,
1

Hi Guys,

Could you please help me on setting TLS cipher in MQ adapter.
we are getting below errors:

We have applied the Integration Server Core 9.7 Fix 18 , Java Package 1.8 and WebSphere MQ Adapter 6.5 Fix 39 and Set the JVM property “-Dcom.ibm.mq.cfg.useIBMCipherMappings=false” as well but still we are getting below errors:

     -   With TLS_RSA_WITH_DES_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA
            Error :

[ART.118.5063] Adapter Runtime (Connection): Unable to start connection :xxxxx after 1 attempt(s).
[ADA.600.3033] Connection to Queue Manager F0QT1 could not be initialized; cc=2,rc=2397.
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host ‘XXX.XX.XXX.XX (1555)’ rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException

  -     With  TLS_RSA_WITH_AES_128_CBC_SHA ,TLS_RSA_WITH_AES_256_CBC_SHA ,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256
             Error:  Connection to Queue Manager F0QT1 could not be initialized; cc=2,rc=2400.

From MQ server side when we asked for below point they are saying this is already cover in MQ 7.5.05 version .

  1. On the WebSphereMQ server, install the iFix provided by IBM that supports TLS Ciphers with Java clients running on a non-IBM JDK.

Could you please suggest me how to fix ( do I need to apply any other setting ) this issue and debug the same?

Thanks in Advance

2

Hi Miki,

please make sure that you have placed the proper jar files in your MQ Adapter.
Additionally check with your MQ Partner that the Channel is configured for TLS too.

The latest MQ Adapter Fix contains a new setting to allow access to both sets of CipherSpecs (SSL and TLS).

You will require the following 5 Jars to get the Adapter working properly:

  • com.ibm.mq.commonservices.jar
  • com.ibm.mq.headers.jar
  • com.ibm.mq.jar
  • com.ibm.mq.jmqi.jar
  • com.ibm.mq.pcf.jar

See Adapter Requirements Guide for reference.

Regards,
Holger

3

IBM now provides one jar file that combines multiple mq library. can you confirm what you had to use?

4

Hi Chirag,

My issue got resolved with updated MQ jars file .
May I know for which MQ version you are trying to connect.
Could you please let us know the Jar version as well.

5

Hi,

when using the recent 9.x jars from IBM MQ you should be able to connect to any MQ server from version 7.x up to 9.x.

Regards,
Holger