| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| CipherSpecs not available on MQ for zOS (v8.0) |
« View previous topic :: View next topic » |
| Author |
Message
|
| saurabh25281 |
 Posted: Wed Jul 10, 2019 8:42 am Post subject: CipherSpecs not available on MQ for zOS (v8.0) |
 |
|
Centurion
Joined: 05 Nov 2006
Posts: 108
Location: Bangalore
|
Hi All,
I am trying to create a SVRCONN channel with SSL CipherSpec as "TLS_RSA_WITH_AES_128_GCM_SHA256" on z/OS platform hosting a v8.0 Queue Manager.
As per the IBM Documentation, the above CipherSpec is a supported one, but I do not see the option of setting this CipherSpec through MQ Explorer. When I try to run MQSC command i get the message "CSQM100I: CSQMACHL SSLCIPH(TLS_RSA_WITH_AES_128_GCM_SHA256) VALUE INVALID OR OUT OF RANGE"
Can someone point me to a documentation which shares this restriction on z/OS?
Regards
Saurabh |
|
| Back to top |
|
 |
| hughson |
| Posted: Wed Jul 10, 2019 3:42 pm Post subject: |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
This page, in the V8 MQ Knowledge Center, shows that TLS_RSA_WITH_AES_128_GCM_SHA256 is a Distributed only CipherSpec at that version.
Changing the version of the page to the V9.1.x version, you see that the platform tag has been removed suggesting it now applies to all platforms. I cannot find a page in the "What's New" section to say when it appeared though.
Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| tczielke |
| Posted: Wed Jul 10, 2019 4:50 pm Post subject: |
|
|
Guardian
Joined: 08 Jul 2010
Posts: 941
Location: Illinois, USA
|
Make sure to note point 4 in the document that Morag referenced about Galois/Counter Mode (GCM) ciphers:
| Quote: |
Following a recommendation by NIST, GCM CipherSpecs have a restriction which means that after 2ˆ22 TLS records are sent, using the same session key, the connection is terminated with message AMQ9288.
To prevent this error from happening: avoid using GCM Ciphers, enable secret key reset, or start your IBM MQ queue manager with the environment variable GSK_ENFORCE_GCM_RESTRICTION=GSK_FALSE set.
|
I like one of the recommendations, just don't use it. 
_________________
Working with MQ since 2010. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
