MQSeries.net :: View topic

Mangesh1187 · Posted: Thu Feb 23, 2017 6:22 am Post subject:

Hi All,

Here is an issue I am facing with the TLS connectivity.

MQ server : 8.0.0.4
JMS Client WAS : 8.5

Previously we had SVRCONN defincation with SSLCIPH(TLS_RSA_WITH_AES_128_CBC_SHA) & SSL_RSA_WITH_AES_128_CBC_SHA cipher cuite on WAS.
This connectivity using TLS1.0 was working fine.

Then we changed the settings of SVRCONN to SSLCIPH(TLS_RSA_WITH_AES_256_CBC_SHA) & SSL_RSA_WITH_AES_256_CBC_SHA ciphercuite on WAS.
Also changed the protocol changes to TLS1.2 in WAS properties.
But connectivity was not working & giving following errors in MQ lgos :

AMQ9616: The CipherSpec proposed is not enabled on the server.

EXPLANATION:
The SSL or TLS subsystem at the server end of a channel been configured in such
a way that it has rejected the CipherSpec proposed by an SSL or TLS client.
This rejection occurred during the secure socket handshake (i.e. it happened
before the proposed CipherSpec was compared with the CipherSpec in the serverchannel definition).

This error most commonly occurs when the choice of acceptable CipherSpecs has
been limited in one of the following ways:
(a) The server queue manager SSLFipsRequired attribute is set to YES and the
channel is using a CipherSpec which is not FIPS-certified on the server.
(b) The server queue manager EncryptionPolicySuiteB attribute has been set to a
value other than NONE and the channel is using a CipherSpec which does not
meet the server's configured Suite B security level.
(c) The protocol used by the channel has been deprecated. Note that IBM may
need to deprecate a protocol via product maintenance in response to a
security vulnerability, for example SSLv3 has been deprecated. Continued use
of SSLv3 protocol is not recommended but may be enabled by setting
environment variable AMQ_SSL_V3_ENABLE=TRUE.

I checked for all this 3 posibilites & below are the configurations on Queue Manager :
(a) SSLFIPS = NO & on client side also its using non-fips configurations.
(b) SUITEB = NONE
(c) As per the link " http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.0.1/com.ibm.mq.csqzaw.doc/ja11320_.htm "
TLS_RSA_WITH_AES_256_CBC_SHA is using TLS1.2 protocol. Hence it seems fine.
Also not set any env variable AMQ_SSL_V3_ENABLE.

I am trying to explore more on this, but no luck so far.
Your feedback will be valuable if someone already faced this kind of issue perticular for TLS_RSA_WITH_AES_128_CBC_SHA & TLS1.2.