| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| MQ8 + SSL + JMS |
« View previous topic :: View next topic » |
| Author |
Message
|
| fjb_saper |
 Posted: Mon Aug 11, 2014 6:05 am Post subject: MQ8 + SSL + JMS |
 |
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Something bizarre.
MQ V8 (with AMS) but this case is not using AMS...
Using the same stores (cms type) works fine in AMS.
Exporting the store to jks, created cms store for the qmgr.
Used the same cert signer as for AMS.
Getting following error on trying to connect via client channel and SSL:
| Code: |
java.security.cert.CertPathValidatorException: Certificate chaining error
Cause is PKIXCertPathBuilderImpl could not build a valid CertPath.
Cause is The certificate issued by CN=fjsca, OU=MQ, O=FJSCA, L=XXX, ST=NY, POSTALCODE=YYYYY, C=US, EMAILADDRESS=zzzzz@msn.com is not trusted
Cause is Certificate chaining error
|
However the same store works for AMS as CMS store.
Is there a problem in the JMS SSL libraries? The JVM used was the MQ V8 JVM...
Now when running with a non IBM JVM I get the following error:
| Code: |
JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2393' ('MQRC_SSL_INITIALIZATION_ERROR').
Cause is CC=2;RC=2393;AMQ9204: Connection to host 'localhost(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Unsupported ciphersuite SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.createSocket,5=default]],3=localhost(1414),5=RemoteTCPConnection.makeSocketSecure]
Cause is CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Unsupported ciphersuite SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.createSocket,5=default]
Cause is Unsupported ciphersuite SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA |
Although at V8 this particular ciphersuite is supposed to be valid as a non fips ciphersuite.... ???
Anybody hitting the same problem? 
_________________
MQ & Broker admin |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Tue Aug 19, 2014 12:44 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Ok found the problems (as usually the hard hard way).
Keep in mind setting -Djavax.net.debug="all" helps.
For the 1st part eclipse was not picking up my truststore correctly. But of course you don't see that but for the trace... as mentioned above...
For the second part use ciphersuite:
cipherspec TLS_RSA_WITH_RC4_128_SHA256
ciphersuite SSL_RSA_WITH_RC4_128_SHA SSLFIPS= false.
That should work with oracle Java 8.
Any attempt to use FIPS with a non IBM JVM without a FIPS certified environment will create a client side FDC with JSSE not Fips compatible, or some message to that effect.
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
