MQSeries.net :: View topic - SSL/TLS: connecting to version 6 qmgr using client channel

relheop · Posted: Tue May 22, 2007 7:55 am Post subject:

Can I connect to V6 queue manager with V5.3 and V6 clients using the same client channel and SSL?

Test results:

1. V5.3 "C" client (via channel tab) -> V6.0 Queue manager works fine with TRIPLE_DES_SHA_US. However, you cannot create a channel tab for a 5.3 client with a Cipher Spec of TLS_RSA_WITH_3DES_EDE_CBC_SHA. This is because it is not one of the MQ5.3 supported Ciphers.

2. V5.3 JMS client (via JNDI) -> V6.0 queue manager works fine with TLS_RSA_WITH_3DES_EDE_CBC_SHA. However if JNDI uses SSL_RSA_WITH_3DES_EDE_CBC_SHA (the V5.3 equivalent of TRIPLE_DES_SHA_US) we get the probelm that is described in the IBM report (namely that Sun Java tries to negotiate using TLS protocol with MQ 5.3 QMs.It then successfully renegotiates down to SSLv3 but V6.0 QMs remain at TLS (since they support TLS now) - thus making the SSL_* ciphers invalid.

3.V6.0 JMS client (via JNDI) to V6.0 queue manager works fine with SSL_RSA_WITH_3DES_EDE_CBC_SHA but we could not get it to work with TLS_RSA_WITH_3DES_EDE_CBC_SHA.

It appears that the only temporary work around is to have a dedicated SVRCONN for 5.3 JMS clients that use Sun Java.

Is that right, or can I use environment variable SSLFIPS=YES to solve the problem?

Any suggestions?
Juergen