MQSeries.net :: View topic - WMB v6.1 and cipherspec TLS_RSA_WITH_AES_256_CBC_SHA

lbart · Posted: Wed Jul 04, 2012 7:43 pm Post subject:

We currently have WMB v6.1.0.2 running on AIX 5.3.
We have a message flow that sends a web service request over HTTPS and we want to use the TLS_RSA_WITH_AES_256_CBC_SHA algorithm.
This did not appear to be available - if we specify TLS_RSA_WITH_AES_256_CBC_SHA in the Allowed SSL ciphers of the HTTPRequest node a subsequent trace produces the following error:

SocketException BIP3165S: An error occurred whilst performing an SSL socket operation. Operation: 'connect'. Error Text: 'java.lang.IllegalArgumentException: Cannot support TLS_RSA_WITH_AES_256_CBC_SHA with currently installed providers'.

I then discovered that in order to use this character set I needed to obtain the unrestricted policy files, which I obtained from https://www.ibm.com/developerworks/java/jdk/security/142/.
I've backed up my original local_policy.jar and US_export_policy.jar and replaced these with the unrestricted versions:
My files are located in /opt/IBM/mqsi/6.1/jre15/lib/security:

drwxr-xr-x 2 root system 4096 23 Oct 08:47 ./
drwxr-xr-x 11 root system 4096 26 Jun 2008 ../
-rwxr-xr-x 1 root system 41155 08 Jul 13:57 cacerts*
-rwxr-xr-x 1 root system 2646 26 Jun 2008 java.policy*
-rwxr-xr-x 1 root system 9609 26 Jun 2008 java.security*
-rwxr-x--- 1 root system 9609 23 Oct 08:47 java.security.20092310*
-rwxr-xr-x 1 root system 3726 23 Oct 08:17 local_policy.jar*
-rwxr-xr-x 1 root system 2683 22 Oct 15:54 local_policy.jar.restrict*
-rwxr-xr-x 1 root system 3726 22 Oct 15:56 local_policy.jar.unrestrict*
-rwxr-xr-x 1 root system 3715 23 Oct 08:16 US_export_policy.jar*
-rwxr-xr-x 1 root system 2201 22 Oct 15:54 US_export_policy.jar.restrict*
-rwxr-xr-x 1 root system 3715 22 Oct 15:56 US_export_policy.jar.unrestrict*

The settings for the user under which our broker is running include the following:
MQSI_JREPATH=/opt/IBM/mqsi/6.1/jre15

Having replaced the policy files I stopped and re-started my broker and re-ran my test. However I still get the same error.
Can anyone tell me what I'm doing wrong? Thanks