ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexIBM MQ Java / JMSJMS TLS with MQ 9.1.0.0 RC 2400

Post new topicReply to topic
JMS TLS with MQ 9.1.0.0 RC 2400 View previous topic :: View next topic
Author Message
crashdog
PostPosted: Fri Sep 04, 2020 4:28 am Post subject: JMS TLS with MQ 9.1.0.0 RC 2400 Reply with quote

Acolyte

Joined: 02 Apr 2017
Posts: 61

Hi all,
I'm trying to get a JMS TLS connection working. The MQ server side is 9.1.0.0 on the client side I've also got an MQ Server 9.1.0.0 on Windows 10.
I've created a jks and an encrypted channel. I can connect to the channel with that jks using MQ Explorer.

However, trying to get a JMS application working fails. As a basis I'm using IBM's example JmsGetPut.java file as described here: https://developer.ibm.com/components/ibm-mq/tutorials/mq-secure-msgs-tls
I've altered the HOST, PORT etc variables to the values for my systems.

I can see that the environment variables are set by outputting them in the app:
javax.net.ssl.trustStorePassword
javax.net.ssl.trustStore
com.ibm.mq.cfg.useIBMCipherMappings : false
javax.net.ssl.trustStoreType : jks

trustStorePassword and trustStore have propper values set. I've also checked that the MQSERVER, MQCHLLIB and MQCHLTAB variables are unset.

Both sides use TLS_RSA_WITH_AES_256_CBC_SHA256 as a cipher (also worked when testing with MQ Explorer).

Error on the client side:
Code:
Exception in thread "main" com.ibm.msg.client.jms.DetailedJMSRuntimeException: JMSWMQ0018: Failed to connect to queue manager 'MYQMGR' with connection mode 'Client' and host name 'null'.
Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information.
   at com.ibm.msg.client.jms.DetailedJMSException.getUnchecked(DetailedJMSException.java:267)
   at com.ibm.msg.client.jms.internal.JmsErrorUtils.convertJMSException(JmsErrorUtils.java:173)
   at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:478)
   at JmsPutGet.main(JmsPutGet.java:114)
Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2400' ('MQRC_UNSUPPORTED_CIPHER_SUITE').
   at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:203)
   at com.ibm.msg.client.wmq.internal.WMQConnection.getConnectOptions(WMQConnection.java:1490)
   at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:354)
   at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:8475)
   at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:7815)
   at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createConnection(JmsConnectionFactoryImpl.java:303)
   at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:444)
   ... 1 more

on the queue manager side:

Code:
09/04/2020 01:19:13 PM - Process(16845.960429) User(mqm) Program(amqrmppa)
                    Host(my-internal-host) Installation(Installation1)
                    VRMF(9.1.0.0) QMgr(MYQMGR)
                    Time(2020-09-04T11:19:13.015Z)
                    RemoteHost(xxx.xxx.xxx.xxx)
                    CommentInsert1(MYCHANNEL.MYAPPID)
                    CommentInsert2(mywsid (xxx.xxx.xxx.xxx))

AMQ9639E: Remote channel 'MYCHANNEL.MYAPPID' did not specify a CipherSpec.

EXPLANATION:
Remote channel 'MYCHANNEL.MYAPPID' did not specify a CipherSpec when the
local channel expected one to be specified.

The remote host is 'mywsid (xxx.xxx.xxx.xxx)'.

The channel did not start.
ACTION:
Change the remote channel 'MYCHANNEL.MYAPPID' on host 'mywsid (xxx.xxx.xxx.xxx)' to
specify a CipherSpec so that both ends of the channel have matching
CipherSpecs.
----- amqcccxa.c : 4053 -------------------------------------------------------
09/04/2020 01:19:13 PM - Process(16845.960429) User(mqm) Program(amqrmppa)
                    Host(my-internal-host) Installation(Installation1)
                    VRMF(9.1.0.0) QMgr(MYQMGR)
                    Time(2020-09-04T11:19:13.016Z)
                    CommentInsert1(MYCHANNEL.MYAPPNAME)
                    CommentInsert2(16845)
                    CommentInsert3(mywsid (xxx.xxx.xxx.xxx))

AMQ9999E: Channel 'MYCHANNEL.MYAPPNAME' to host 'mywsid (xxx.xxx.xxx.xxx)' ended
abnormally.

EXPLANATION:
The channel program running under process ID 16845 for channel
'MYCHANNEL.MYAPPNAME' ended abnormally. The host name is 'mywsid (xxx.xxx.xxx.xxx)';
in some cases the host name cannot be determined and so is shown as '????'.
ACTION:
Look at previous error messages for the channel program in the error logs to
determine the cause of the failure. Note that this message can be excluded
completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
found in the System Administration Guide.
----- amqrmrsa.c : 945 --------------------------------------------------------



As for the error messages the ciphers are set on the channel and in the application.
Code:

cf.setStringProperty(WMQConstants.WMQ_SSL_CIPHER_SUITE, "TLS_RSA_WITH_AES_256_CBC_SHA256");


Above java error is from when I run it from Eclipse. When I run it from the cmd I get a different error even though the java version classpath etc are the same:
Code:
 C:\Users\myuserid\Documents\orgbox>java -classpath ".\;C:\Program Files\IBM\MQ\java\lib\com.ibm.mq.allclient.jar;C:\Program Files\IBM\MQ\java\lib\jms.jar;C:\Program Files\IBM\MQ\java\lib\com.ibm.mq.jar" -Djavax.net.ssl.trustStorePassword="MY_KEYSTORES_PWD" -Djavax.net.ssl.trustStore="C:/Users/myuserid/Documents/orgbox/key.jks" -Djavax.net.ssl.trustStoreType="jks" -Dcom.ibm.mq.cfg.useIBMCipherMappings="false" JmsPutGet
Exception in thread "main" com.ibm.msg.client.jms.DetailedJMSRuntimeException: JMSWMQ0018: Failed to connect to queue manager 'MYQMGR' with connection mode 'Client' and host name 'my-internal-hostname(1413)'.
Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information.
        at com.ibm.msg.client.jms.DetailedJMSException.getUnchecked(DetailedJMSException.java:267)
        at com.ibm.msg.client.jms.internal.JmsErrorUtils.convertJMSException(JmsErrorUtils.java:173)
        at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:478)
        at JmsPutGet.main(JmsPutGet.java:104)
Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2397' ('MQRC_JSSE_ERROR').
        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:203)
        at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:424)
        at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7ProviderConnection(WMQConnectionFactory.java:8475)
        at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProviderConnection(WMQConnectionFactory.java:7815)
        at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createConnection(JmsConnectionFactoryImpl.java:303)
        at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createContext(JmsConnectionFactoryImpl.java:444)
        ... 1 more
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host 'my-internal-hostname(1413)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9641: Remote CipherSpec error for channel 'MYCHANNEL.MYAPPNAME' to host ''. [3=MYCHANNEL.MYAPPNAME]],3=my-internal-host(1413),5=RemoteConnection.analyseErrorSegment]
        at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:2302)
        at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1273)
        at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJmqiImpl.java:377)
        at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:562)
        at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnection.java:357)
        ... 5 more
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9641: Remote CipherSpec error for channel 'MYCHANNEL.MYAPPNAME' to host ''. [3=MYCHANNEL.MYAPPNAME]
        at com.ibm.mq.jmqi.remote.impl.RemoteConnection.analyseErrorSegment(RemoteConnection.java:4651)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnection.receiveTSH(RemoteConnection.java:3386)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnection.initSess(RemoteConnection.java:1424)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:1014)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:416)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:312)
        at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:155)
        at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1749)
        ... 9 more


This is another one where I feel a bit lost and can't think of another thing to check.... so any help is appreciated.

Kind Regards,

Gerhard
_________________
You win again gravity !
Back to top
View user's profile Send private message
crashdog
PostPosted: Fri Sep 04, 2020 7:03 am Post subject: Reply with quote

Acolyte

Joined: 02 Apr 2017
Posts: 61

After lots of try 'n' error I got it running. Not sure which tweak actually was the lucky one. I will look closer into it and if I may post the fix.

Cheers,
Gerhard
_________________
You win again gravity !
Back to top
View user's profile Send private message
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexIBM MQ Java / JMSJMS TLS with MQ 9.1.0.0 RC 2400
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.