ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexWebSphere Message Broker SupportDisable SSL for IIB Inbound Webservices

Post new topicReply to topic
Disable SSL for IIB Inbound Webservices View previous topic :: View next topic
Author Message
chaithuboby
PostPosted: Thu Apr 04, 2019 6:54 am Post subject: Disable SSL for IIB Inbound Webservices Reply with quote

Newbie

Joined: 22 Jun 2017
Posts: 4

Due to security constraints , we need to disable SSL protocols to IIB inbound webservices and allow only TLS or higher version protocols.

We ran the below commands to enable TLS in broker and Integration server:

mqsichangeproperties broker_name -b httplistener -o HTTPSConnector -n sslProtocol -v TLS

mqsichangeproperties broker_name -e EG_NAME -o HTTPSConnector -n sslProtocol -v TLS

Through a mock service with HTTP Request node and its protocol set as SSL, we tried invoking our exposed HTTP services. Expected outcome is that the invoked service should not accept SSL request. But the service still accepted SSL protocol request and processed it.

As per IBM documentation,by setting the ssl protocol to TLS,we still enable the SSL versions of protocols

https://www.ibm.com/support/knowledgecenter/en/SSYKE2_7.1.0/com.ibm.java.security.component.71.doc/security-component/jsse2Docs/protocols.html

Kindly advise on blocking SSL altogether and allow only TLS or higher.
Back to top
View user's profile Send private message
Vitor
PostPosted: Thu Apr 04, 2019 7:04 am Post subject: Re: Disable SSL for IIB Inbound Webservices Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 25823
Location: Ohio, USA

chaithuboby wrote:
Through a mock service with HTTP Request node and its protocol set as SSL, we tried invoking our exposed HTTP services. Expected outcome is that the invoked service should not accept SSL request. But the service still accepted SSL protocol request and processed it.


From the very page you quote:

Quote:

Protocol Comment
SSL Enables TLS v1.0, v1.1, and v1.2 protocols. (See Note)

Note
For SSL and SSLv3 parameters, the default protocols that are enabled are changed as a result of security vulnerabilities, as described later in this topic.


So setting "SSL" on an HTTPRequest node will result in the use of TLS.

Try the test again with SoapUI or curl.

Also, and depending on how secure you want to be, you shouldn't be accepting TLSv1.0 and should be a bit wary of TLSv1.1
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexWebSphere Message Broker SupportDisable SSL for IIB Inbound Webservices
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.