What's changed in IBM MQ 9.3.0 Long Term Support

The Long Term Support (LTS) release is a recommended product level for which support, including defect and security updates, is provided over a specified period of time.

LTS releases do not deliver new functional enhancements. They contain only defect fixes and security updates, and are made available at regular intervals. They are intended for systems that demand maximum stability over a long term deployment period.

For more information see IBM® MQ release types and versioning and IBM MQ FAQ for Long Term Support and Continuous Delivery releases.

For Long Term Support, maintenance updates for IBM MQ 9.3.0 for Multiplatforms and IBM MQ Appliance are provided as fix packs or cumulative security updates (CSUs).

Note: From 1Q 2023, for Multiplatforms, there are two types of maintenance:

Fix packs, which contain roll-ups of all defects fixed since the previous fix pack delivery (or GA). Fix packs are produced exclusively for Long Term Support (LTS) releases during their normal support lifecycle.
Cumulative security updates (CSUs), which are smaller updates and contain security patches released since the previous maintenance (GA). CSUs are produced for LTS releases (including releases in extended support), and also for the latest IBM MQ Continuous Delivery (CD) release, as required to deliver relevant security patches.

For maintenance releases in or after 1Q 2023, the fourth digit in the VRMF represents either a fix pack number or a CSU number. Both types of maintenance are mutually cumulative (that is, they contain everything included in older CSUs and fix packs), and both are installed using the same mechanisms for applying maintenance. Both types of maintenance update the F-digit of the VRMF to a higher number than any previous maintenance: fix packs use "F" values divisible by 5, CSUs use "F" values not divisible by 5.

For maintenance releases before 1Q 2023, the fourth digit in the VRMF always represents the fix pack level. For example, the first fix pack of the IBM MQ 9.3.0 LTS release is numbered 9.3.0.1.

For more information, see Changes to IBM MQ's maintenance delivery model.

[z/OS] For z/OS®, maintenance updates are provided as Program Temporary Fixes (PTFs) or cumulative security updates (CSUs). For z/OS UNIX System Services features (that is, JMS, REST API and IBM MQ Console, and Managed File Transfer) the z/OS PTFs are aligned directly with the Multiplatforms fix packs. Other PTFs are made available as and when they are produced.

IBM MQ 9.3.0 CSU 37

Changes to supported signature algorithms when operating in FIPS mode

From IBM MQ 9.3.0 CSU 37, the IBM Java 8 JRE removes support for reading an RSA KeyPair with one security provider that has been generated by another security provider when operating in FIPS mode. Any attempt to do this will result in the following exception being thrown:

javax.net.ssl.SSLException: No supported signature algorithm for RSA  key

For more information, see APAR IJ53002.

This exception might be seen when using one of the following components:

AMQP server
Managed File Transfer (MFT)
IBM MQ Console
IBM MQ Explorer
IBM MQ REST API
IBM MQ Telemetry service

To resolve the issue, you should regenerate your certificates using the IBMJCEPlusFIPS provider.

Disabled CipherSuites

From IBM MQ 9.3.0 CSU 37, the IBM Java 8 JRE disables TLS_RSA CipherSuites by default. This affects the following components:

AMQP server
Managed File Transfer (MFT)
IBM MQ Console
IBM MQ Explorer
IBM MQ REST API
IBM MQ Telemetry service

If you are using one of these components with a TLS_RSA CipherSuite, you have two options:

Change the component to use a different CipherSuite.
Re-enable the CipherSuites by removing the entry:
```
TLS_RSA_*
```
from the jdk.tls.disabledAlgorithms property in the JRE's java.security file. The location of the file for each platform is shown in the following table:
Table 1. Location of the java.security file

Platform Directory

AIX® and Linux® MQ_INSTALLATION_PATH/java/jre/lib/security

Windows MQ_INSTALLATION_PATH\java\jre\lib\security

Table 1. Location of the java.security file
Platform	Directory
AIX® and Linux®	MQ_INSTALLATION_PATH/java/jre/lib/security
Windows	MQ_INSTALLATION_PATH\java\jre\lib\security

IBM MQ 9.3.0 Fix Pack 35

There are no documentation updates relating to changes to functions and resources in IBM MQ 9.3.0 Fix Pack 35.

IBM MQ 9.3.0 Fix Pack 30

IBM MQ 9.3.0 Fix Pack 25

There are no documentation updates relating to changes to functions and resources in IBM MQ 9.3.0 Fix Pack 25.

IBM MQ 9.3.0 Fix Pack 20

IBM MQ 9.3.0 CSU 17

Removal of support for RSA key exchange when operating in FIPS mode

From IBM MQ 9.3.0 CSU 17, the IBM Java 8 JRE removes support for RSA key exchange when operating in FIPS mode. This removal applies to the following CipherSuites:

TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

To continue using FIPS mode, the following IBM MQ components should be changed to use a CipherSuite that is still supported:

AMQP server
Managed File Transfer (MFT)
IBM MQ Console
IBM MQ Explorer
IBM MQ REST API
IBM MQ Telemetry service

For more information, see TLS CipherSpecs and CipherSuites in IBM MQ classes for Java.

IBM MQ 9.3.0 Fix Pack 15

Note: The IBM MQ Bridge to blockchain component of IBM MQ Advanced is deprecated across all releases from November 22 2022 (see US Announcement letter 222-341) and the capability is removed from Long Term Support at IBM MQ 9.3.0 Fix Pack 15. Blockchain connectivity can be achieved with IBM App Connect or through App Connect capabilities available with IBM Cloud Pak® for Integration. If you have applications that will be impacted by this change, please contact IBM Support.

IBM MQ 9.3.0 Fix Pack 10

Change to spelling of Java system property used by Managed File Transfer

IBM MQ 9.3.0 Fix Pack 5

New OAMLdapResponseWarningTime parameter in TuningParameters stanza of qm.ini

IBM MQ 9.3.0 Fix Pack 2

IBM MQ 9.3.0 Fix Pack 2 adds the following support:

Support for RHEL 9
For queue managers in IBM MQ Long Term Support (LTS), you must download the manufacturing refresh from Passport Advantage®: M090WML IBM MQ 9.3.0.2 Long Term Support release for Linux on x86 64-bit eImage
Support for Ubuntu 22.04
For queue managers in IBM MQ Long Term Support (LTS), you must download the manufacturing refresh from Passport Advantage: M090SML IBM MQ 9.3.0.2 Long Term Support release for Ubuntu on x86 64-bit eImage

IBM MQ 9.3.0 Fix Pack 1

There are no documentation updates relating to changes to functions and resources in IBM MQ 9.3.0 Fix Pack 1.