IT35078: Improve error message when a certificate does not meet key length requirements

APAR status

• Closed as program error.

Error description

• If an attempt was made to establish a TLS connection using a
  certificate with an insufficient key length, a generic AMQ9620E
  error was reported in the MQ error log.
  
  The AMQ9620E reports "Internal error on call to SSL function",
  with error code '457'.
  
  This APAR improves this message to highlight the root cause to
  the user.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of MQ with TLS-protected channels.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  The generic AMQ9620E message did not provide sufficient clarity
  to the user in this scenario.
  

Problem conclusion

• In the scenario where a certificate's key length is
  insufficient, the error log will now report either AMQ9633E (if
  the remote peer certificate is at fault) or AMQ9797E (if the
  local certificate is at fault). The explanations of these
  messages have been updated to describe this scenario.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 LTS   9.1.0.8
  v9.2 LTS   9.2.0.2
  v9.x CD    9.2.2
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels