IT31529: .NET client connecting with a TLS enabled channel fails with RC=2538 when using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

APAR status

• Closed as program error.

Error description

• A managed .NET Client application fails to connect to a queue
  manager via
  a TLS enabled channel using the
  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipherspec.
  
  It fails with return code 2538 (MQRC_HOST_NOT_AVAILABLE ), and
  the Windows event log reports "A fatal error occurred while
  creating an SSL client credential. The internal error state is
  10013."
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users using a fully managed .NET MQ client connecting with a
  TLS enabled channel using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
   cipherspec
  
  
  Platforms affected:
  Windows, Linux on x86-64
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  MQ managed .NET client code was missing to include
  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and
  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384 ciphers in IBM MQ and
  Microsoft.NET mapping table. This caused the .NET
  client to propose the default protocol level of either SSL3.0 or
  TLS 1.0 to the server during the handshake. The server was
  configured to reject this proposal.
  

Problem conclusion

• The MQ managed .NET client code has been corrected such that it
  include TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and
  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384 ciphers in IBM MQ and
  Microsoft.NET mapping table, so that correct SSL/TLS protocol
  version will be proposed to the server by the client.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 LTS   9.1.0.6
  v9.x CD    T.B.C.
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels