| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| JMS TLS with MQ 9.1.0.0 RC 2400 |
« View previous topic :: View next topic » |
| Author |
Message
|
| crashdog |
 Posted: Fri Sep 04, 2020 4:28 am Post subject: JMS TLS with MQ 9.1.0.0 RC 2400 |
 |
|
Voyager
Joined: 02 Apr 2017
Posts: 77
|
Hi all,
I'm trying to get a JMS TLS connection working. The MQ server side is 9.1.0.0 on the client side I've also got an MQ Server 9.1.0.0 on Windows 10.
I've created a jks and an encrypted channel. I can connect to the channel with that jks using MQ Explorer.
However, trying to get a JMS application working fails. As a basis I'm using IBM's example JmsGetPut.java file as described here: https://developer.ibm.com/components/ibm-mq/tutorials/mq-secure-msgs-tls
I've altered the HOST, PORT etc variables to the values for my systems.
I can see that the environment variables are set by outputting them in the app:
javax.net.ssl.trustStorePassword
javax.net.ssl.trustStore
com.ibm.mq.cfg.useIBMCipherMappings : false
javax.net.ssl.trustStoreType : jks
trustStorePassword and trustStore have propper values set. I've also checked that the MQSERVER, MQCHLLIB and MQCHLTAB variables are unset.
Both sides use TLS_RSA_WITH_AES_256_CBC_SHA256 as a cipher (also worked when testing with MQ Explorer).
Error on the client side:
| Code: |
Exception in thread "main" com.ibm.msg.client.jms.DetailedJMSRuntimeException: JMSWMQ0018: Failed to connect to queue manager 'MYQMGR' with connection mode 'Client' and host name 'null'.
Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information.
at com.ibm.msg.client.jms.DetailedJMSException.getUnchecked(DetailedJMSException.java:267)
at com.ibm.msg.client.jms.internal.JmsErrorUtils.convertJMSException(JmsErrorUtils.java:173)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:478)
at JmsPutGet.main(JmsPutGet.java:114)
Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2400' ('MQRC_UNSUPPORTED_CIPHER_SUITE').
at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:203)
at com.ibm.msg.client.wmq.internal.WMQConnection.getConnectOptions(WMQConnection.java:1490)
at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:354)
at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:8475)
at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:7815)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createConnection(JmsConnectionFactoryImpl.java:303)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:444)
... 1 more
|
on the queue manager side:
| Code: |
09/04/2020 01:19:13 PM - Process(16845.960429) User(mqm) Program(amqrmppa)
Host(my-internal-host) Installation(Installation1)
VRMF(9.1.0.0) QMgr(MYQMGR)
Time(2020-09-04T11:19:13.015Z)
RemoteHost(xxx.xxx.xxx.xxx)
CommentInsert1(MYCHANNEL.MYAPPID)
CommentInsert2(mywsid (xxx.xxx.xxx.xxx))
AMQ9639E: Remote channel 'MYCHANNEL.MYAPPID' did not specify a CipherSpec.
EXPLANATION:
Remote channel 'MYCHANNEL.MYAPPID' did not specify a CipherSpec when the
local channel expected one to be specified.
The remote host is 'mywsid (xxx.xxx.xxx.xxx)'.
The channel did not start.
ACTION:
Change the remote channel 'MYCHANNEL.MYAPPID' on host 'mywsid (xxx.xxx.xxx.xxx)' to
specify a CipherSpec so that both ends of the channel have matching
CipherSpecs.
----- amqcccxa.c : 4053 -------------------------------------------------------
09/04/2020 01:19:13 PM - Process(16845.960429) User(mqm) Program(amqrmppa)
Host(my-internal-host) Installation(Installation1)
VRMF(9.1.0.0) QMgr(MYQMGR)
Time(2020-09-04T11:19:13.016Z)
CommentInsert1(MYCHANNEL.MYAPPNAME)
CommentInsert2(16845)
CommentInsert3(mywsid (xxx.xxx.xxx.xxx))
AMQ9999E: Channel 'MYCHANNEL.MYAPPNAME' to host 'mywsid (xxx.xxx.xxx.xxx)' ended
abnormally.
EXPLANATION:
The channel program running under process ID 16845 for channel
'MYCHANNEL.MYAPPNAME' ended abnormally. The host name is 'mywsid (xxx.xxx.xxx.xxx)';
in some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 945 --------------------------------------------------------
|
As for the error messages the ciphers are set on the channel and in the application.
| Code: |
cf.setStringProperty(WMQConstants.WMQ_SSL_CIPHER_SUITE, "TLS_RSA_WITH_AES_256_CBC_SHA256");
|
Above java error is from when I run it from Eclipse. When I run it from the cmd I get a different error even though the java version classpath etc are the same:
| Code: |
C:\Users\myuserid\Documents\orgbox>java -classpath ".\;C:\Program Files\IBM\MQ\java\lib\com.ibm.mq.allclient.jar;C:\Program Files\IBM\MQ\java\lib\jms.jar;C:\Program Files\IBM\MQ\java\lib\com.ibm.mq.jar" -Djavax.net.ssl.trustStorePassword="MY_KEYSTORES_PWD" -Djavax.net.ssl.trustStore="C:/Users/myuserid/Documents/orgbox/key.jks" -Djavax.net.ssl.trustStoreType="jks" -Dcom.ibm.mq.cfg.useIBMCipherMappings="false" JmsPutGet
Exception in thread "main" com.ibm.msg.client.jms.DetailedJMSRuntimeException: JMSWMQ0018: Failed to connect to queue manager 'MYQMGR' with connection mode 'Client' and host name 'my-internal-hostname(1413)'.
Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information.
at com.ibm.msg.client.jms.DetailedJMSException.getUnchecked(DetailedJMSException.java:267)
at com.ibm.msg.client.jms.internal.JmsErrorUtils.convertJMSException(JmsErrorUtils.java:173)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:478)
at JmsPutGet.main(JmsPutGet.java:104)
Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2397' ('MQRC_JSSE_ERROR').
at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:203)
at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:424)
at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:8475)
at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:7815)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createConnection(JmsConnectionFactoryImpl.java:303)
at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:444)
... 1 more
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host 'my-internal-hostname(1413)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9641: Remote CipherSpec error for channel 'MYCHANNEL.MYAPPNAME' to host ''. [3=MYCHANNEL.MYAPPNAME]],3=my-internal-host(1413),5=RemoteConnection.analyseErrorSegment]
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:2302)
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1273)
at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJmqiImpl.java:377)
at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:562)
at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:357)
... 5 more
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9641: Remote CipherSpec error for channel 'MYCHANNEL.MYAPPNAME' to host ''. [3=MYCHANNEL.MYAPPNAME]
at com.ibm.mq.jmqi.remote.impl.RemoteConnection.analyseErrorSegment(RemoteConnection.java:4651)
at com.ibm.mq.jmqi.remote.impl.RemoteConnection.receiveTSH(RemoteConnection.java:3386)
at com.ibm.mq.jmqi.remote.impl.RemoteConnection.initSess(RemoteConnection.java:1424)
at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:1014)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:416)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:312)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:155)
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1749)
... 9 more
|
This is another one where I feel a bit lost and can't think of another thing to check.... so any help is appreciated.
Kind Regards,
Gerhard
_________________
You win again gravity ! |
|
| Back to top |
|
 |
| crashdog |
| Posted: Fri Sep 04, 2020 7:03 am Post subject: |
|
|
Voyager
Joined: 02 Apr 2017
Posts: 77
|
After lots of try 'n' error I got it running. Not sure which tweak actually was the lucky one. I will look closer into it and if I may post the fix.
Cheers,
Gerhard
_________________
You win again gravity ! |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
