MQSeries.net :: View topic

venusboy · Posted: Thu Aug 09, 2007 9:24 am Post subject:

Hello,

I have recently upgraded a Solaris 8 server from WMQv5 CSD10 to WMQv6.0.2.1. We have numerous Java clients connecting to WMQ using SSL that have been working fine in version 5.

However in version 6 I get the following exception:

08/06/07 14:50:35 - Process(907.1

User(mqsi) Program(amqrmppa)
AMQ9631: The CipherSpec negotiated during the SSL handshake does not match the
required CipherSpec for channel 'XXXXX'.

EXPLANATION:
There is a mismatch between the CipherSpecs on the local and remote ends of
channel 'XXXXX. The channel will not run until this mismatch is
resolved. The CipherSpec required in the local channel definition is
'RC4_SHA_US'. The name of the CipherSpec negotiated during the SSL handshake is
'RC4_SHA_US'. A code is displayed if the name of the negotiated CipherSpec
cannot be determined.
ACTION:
Change the channel definitions for 'XXXXX' so the two ends have
matching CipherSpecs and restart the channel. If the certificate in use by one
end of the channel is a Global Server Certificate, then the negotiated
CipherSpec may not match that specified on either end of the channel. This is
because the SSL protocol allows a Global Server Certificate to automatically
negotiate a higher level of encryption. In these cases specify a CipherSpec
which meets the requirements of the Global Server Certificate.
----- amqccisa.c : 851 --------------------------------------------------------

I have read http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg1IY79142 but I am using RC4_SHA_US and read the documentation on the mismatches, but nothing really sprang out.

How do I know if the CipherSpec meets the requirements of the Global Server Certificate? Especially if this works fine in version 5 and works for non-Java clients.

Interesting the following hold true:

1. If I use the IBM JDK that resides within the mq_install/ssl directory then it connects fine. Assuming it's due to the extra security policy required by the GSK.
2. If I use the IBM JDK that does not reside within the mq_install/ssl it fails. It also fails on the standard Sun JDK (used 1.4.2.05 to 1.4.2.15).
3. C/C++ applications using SSL work fine (however these do use the CMS).
4. Going though all the CipherSpec supported, only TLS seem to work.

Has anyone got any ideas why it only works with the TLS?

Note - Am using JMS and am using the version 5 library files.