CipherSpec values supported in IBM WebSphere MQ
The set of default CipherSpecs allows only the following values:
- TLS 1.0
-
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_256_CBC_SHA
- TLS 1.2
-
- ECDHE_ECDSA_AES_128_CBC_SHA256
- ECDHE_ECDSA_AES_256_CBC_SHA384
- ECDHE_ECDSA_AES_128_GCM_SHA256
- ECDHE_ECDSA_AES_256_GCM_SHA384
- ECDHE_RSA_AES_128_CBC_SHA256
- ECDHE_RSA_AES_256_CBC_SHA384
- ECDHE_RSA_AES_128_GCM_SHA256
- ECDHE_RSA_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_CBC_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA256
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_GCM_SHA384
Enabling deprecated CipherSpecs
By default, you are not allowed to specify a deprecated CipherSpec on a channel definition. If you attempt to specify a deprecated CipherSpec, you receive message AMQ9788 in the error log for the queue manager.
It is possible for you to re-enable the deprecated CipherSpecs by editing the
qm.ini
file. Within the SSL stanza of the qm.ini
file, add the
following line:SSL:
AllowWeakCipherSpec=Yes
You can also re-enable one or more of the deprecated CipherSpecs at runtime on the server by
setting the environment variable AMQ_SSL_WEAK_CIPHER_ENABLE to any value. This
environment variable enables the CipherSpecs regardless of the value that is specified in the
qm.ini
file.