IT42642: CLIENT CONNECTION FAILS WITH REASON CODE 2594 MQRC_PASSWORD PROTECTION_ERROR DUE TO INVALID PROTALG NEGOTIATED BY SERVER

APAR status

• Closed as program error.

Error description

• If an MQ client channel is configured to use a cipher with NULL
  encryption (e.g. TLS_RSA_WITH_NULL_SHA256) and the SVRCONN
  channel uses an alias cipher (e.g. SSLCIPH(ANY) ) then the
  server will negotiate an invalid PROTALG.
  This causes the client's connection to fail with reason code
  2594 MQRC_PASSWORD_PROTECTION_ERROR.
  

Local fix

• Re-configure the client's channel to use a cipher with non-NULL
  encryption.
  

Problem summary

• MQ channel logic is incorrectly using the configured server
  channel cipher to determine the PROTALG for the connection.
  

Problem conclusion

• MQ channel was revised to use the negotiated session cipher
  rather than the configured cipher.
  ---------------------------------------------------------------
  The fix is targeted for delivery in maintenance level 8.1.0.12
  of IBM MQ for HPE NonStop 8.1.
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ FOR HPE NS O

• Fixed component ID

  5724A3904

Applicable component levels