IT31843: Using MQ Explorer against z/OS to create a channel does not enable the selection of certain SSL ciphers.

APAR status

• Closed as program error.

Error description

• Attempted to set the cipher spec on a z/OS QMGR via MQExplorer
  and the following cipher spec in question is not a valid option
  in the drop-down list.
  Cipher in question (ECDHE_RSA_AES_256_GCM_SHA384) was added by
  PTF UI53263 (V900).
  
  This PTF introduced support for both of the cipher specs below:
  
  ECDHE_RSA_AES_128_GCM_SHA256
  ECDHE_RSA_AES_256_GCM_SHA384
  
  Fix in this case would be similar to IT26496 by adding the
  appropriate z/OS tag for both of the above cipher specs to
  DmChannel.xml.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  This issue affects users of the IBM MQ Explorer who want to
  add/change the channel cipher spec option on a channel of a
  queue manager running on an IBM MQ on z/OS.
  
  
  Platforms affected:
  Windows, Linux on x86-64, z/OS
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  If Queue Manager is running on z/OS and accessing this via IBM
  MQ Explorer, the channels SSL properties does not show all the
  available ciphers in the drop down list.
  
  The missing cipher spec are:
  
  ECDHE_RSA_AES_128_GCM_SHA256
  ECDHE_RSA_AES_256_GCM_SHA384
  

Problem conclusion

• IBM MQ Explorer was updated to show all the supported cipher
  spec options when connected to a queue manager running on an IBM
  MQ z/OS.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 CD    TBC.
  v9.1 LTS   9.1.0.6
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels