MQSeries.net :: View topic

venkataa · Posted: Thu Jun 29, 2017 9:42 am Post subject: How to enable TLS Ciphers

Hi Masters,

I am using IIBv10.0.0.7 on AIX operating system. My requirement is to connect one SOAP service who is allowing only TLSv1.2 protocol with ECDHE ciphers only.
During initial days, i got below exception which was resolved after copying unrestricted policy files of Java v7.

Exception in thread "Thread-44" 2017-06-22 19:05:39.997 67 java.lang.IllegalArgumentException: Cannot support TLS_ECDHE_RSA_WITH_A
ES_256_GCM_SHA384 with currently installed providers

Now this exception is stopped coming, but still the connection is not establishing. I have tried different different approaches none worked so far.

Even i specify TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as cipher, it is taking as SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384 during connection(Checked on stdout log). So stopped specifying explicitly.

Please check the JSSE out put detials below.

2017-06-29 16:16:11.276 64 Cipher Suites: [TLS_EMPTY_RENEGOTIATION_INFO_SCSV, SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, SSL_ECDHE_R
SA_WITH_AES_256_CBC_SHA384, SSL_RSA_WITH_AES_256_CBC_SHA256, SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, SSL_ECDH_RSA_WITH_AES_256_CBC_SHA
384, SSL_DHE_RSA_WITH_AES_256_CBC_SHA256, SSL_DHE_DSS_WITH_AES_256_CBC_SHA256, SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDHE_RSA_WIT
H_AES_256_CBC_SHA, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_RSA_W
ITH_AES_256_CBC_SHA, SSL_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
SSL_RSA_WITH_AES_128_CBC_SHA256, SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, SSL_ECDH_RSA_WITH_AES_128_CBC_SHA256, SSL_DHE_RSA_WITH_AES_1
28_CBC_SHA256, SSL_DHE_DSS_WITH_AES_128_CBC_SHA256, SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_
WITH_AES_128_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DH
E_DSS_WITH_AES_128_CBC_SHA, SSL_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_ED
E_CBC_SHA]
2017-06-29 16:16:11.278 64 Compression Methods: { 0 }
2017-06-29 16:16:11.278 64 Extension elliptic_curves, curve names: {secp256r1, secp192r1, secp224r1, secp384r1, secp521r1, secp160
k1, secp160r1, secp160r2, secp192k1, secp224k1, secp256k1}
2017-06-29 16:16:11.278 64 Extension ec_point_formats, formats: [uncompressed]
2017-06-29 16:16:11.278 64 Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA,
SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA256withDSA, SHA1withDSA
2017-06-29 16:16:11.278 64 ***