| Author |
Message
|
| zpat |
 Posted: Thu Oct 27, 2011 2:53 am Post subject: WMB 7003, SSL problem in SOAP request node |
 |
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
| Quote: |
| BIP3165S: An error occurred whilst performing an SSL socket operation. Operation: initiateSslHandshake. Error Text: java.net.SocketException: java.security.NoSuchAlgorithmException: SSLContext Default implementation not found: |
Any idea what this can be caused by? |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Thu Oct 27, 2011 5:48 am Post subject: Re: WMB 7003, SSL problem in SOAP request node |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| zpat wrote: |
| Quote: |
| java.net.SocketException: java.security.NoSuchAlgorithmException: SSLContext Default implementation not found: |
Any idea what this can be caused by? |
This is the relevant part.
What Algorithm (CipherSuite) are you trying to use?
What has me even more worried is the second part: SSLContext Default implementation not found
Are you 100% sure your java installation / setup is correct? 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| zpat |
| Posted: Thu Oct 27, 2011 5:59 am Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
It's interesting, there are two relevant property names
| Quote: |
HTTPSConnector
uuid='HTTPSConnector'
userTraceLevel='none'
traceLevel='none'
userTraceFilter='none'
traceFilter='none'
port='0'
address=''
allowTrace=''
maxPostSize=''
acceptCount=''
bufferSize=''
compressableMimeTypes=''
compression=''
connectionLinger=''
connectionTimeout=''
maxHttpHeaderSize=''
maxKeepAliveRequests=''
maxSpareThreads=''
maxThreads=''
minSpareThreads=''
noCompressionUserAgents=''
restrictedUserAgents=''
socketBuffer=''
tcpNoDelay=''
explicitlySetPortNumber='6666'
enableLookups=''
enableMQListener=''
shutdownDelay=''
algorithm=''
clientAuth=''
keystoreFile='/MYDIR/my_keystore.jks'
keystorePass='********'
keystoreType=''
sslProtocol='SSL'
ciphers=''
keypass='********'
keyAlias=''
sslSessionTimeout='' |
They are not the same thing. The default algorithim varies per platform - on AIX it is IBMx509. It's used for certificate encryption.
I tried specifiying a JSSE cipher name, didn't change anything. Null means try all available ciphers.
What or where is the default JSSE envionment for a WMB 7 broker on AIX 5.3 ?
The developer has this working on Windows WMB 7, so it looks like an environmental issue of some kind. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Thu Oct 27, 2011 6:34 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Oct 27, 2011 6:35 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
I am certain we disagree on the interpretation of algorithms.
What you described (X509, whether IBM or Sun) is more of a protocol than an algorithm. An algorithm would be something like rsaEncryption or for a signature md5WithRSAEncryption, hence my pointer towards a ciphersuite which makes use of algorithms.
If your defaultSSLContext fails there is a good chance your SSL setup is not right or complete or initialized, and you would not be able to do anything.
Also trying to do encryption without the proper keystore could produce some of the results you're seeing. Remember that the key algorithm will ultimately decide what ciphersuites are available to you. If you are trying to use FIPS all your key sizes should be >= 2048
Check your JCE & JGSSE providers (jre/lib/security/java.security and jre/lib/security/java.policy) as they determine the defaults.
And to verify and complete your setup follow the links Jeff provided so gracefully.
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| zpat |
| Posted: Thu Oct 27, 2011 12:04 pm Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
I have a JKS keystore (created with WMQ 7016 ikeyman) that I have set as the keystore and truststore at EG level.
It has a personal cert from a third-party for use with their web-service and also a signer cert from them.
As I mentioned, the developer has it working fine on his PC. I have replicated all the configuration that he used and yet it fails on AIX.
Is the JSSE environment supplied with each broker version or does it use the operating system one?
Can I verify the JSSE outside of WMB? |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Oct 27, 2011 12:15 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Is there a difference on AIX vs Winx for the following files ? (jre/lib/security/java.security and jre/lib/security/java.policy) and you need to look at the broker's jre
Are all the providers described in java.security available?
The easier way would probably be to open a PMR...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| mqjeff |
| Posted: Thu Oct 27, 2011 1:57 pm Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
| zpat wrote: |
| Is the JSSE environment supplied with each broker version |
This. |
|
| Back to top |
|
|
| zpat |
| Posted: Fri Oct 28, 2011 12:00 am Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
The java.policy and java.security file contents are identical in
C:\Program Files\IBM\MQSI\7.0\jre16\lib\security
and in
/opt/IBM/mqsi/7.0/jre16/lib/security |
|
| Back to top |
|
|
|
|
