IBM Support

IT23995: IBM MQ .NET managed client proposes incorrect SSL/TLS protocol level

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • MQ .NET Managed client proposes incorrect SSL/TLS Protocol
    leading to CipheSpec mismatches reported in the server and
    MQRC_Q_MGR_NOT_AVAILABLE reported to the client application.
    
    The client application has set cipherspec RC4_SHA_US  and the
    svrconn channel has set cipherspec RC4_SHA_US.
    
    0000032F 14:44:32.521295   6972.1           :       Exception
    received
    IBM.WMQ.Nmqi.NmqiException
    Message: MQRC_Q_MGR_NOT_AVAILABLE
    StackTrace:
       at
    IBM.WMQ.Nmqi.MQFAPConnection.Connect(MQConnectionSecurityParamet
    ers securityParms)
       at
    IBM.WMQ.Nmqi.MQConnectionSpecification.CreateAndConnectConnectio
    n(MQChannelDefinition mqcd, MQSSLConfigOptions sslConfigOptions,
    MQConnectionSecurityParameters mqcsp, MQFAP fap, String
    qMgrName, Int32 connectOptions, Int32 maxFapLevel)
    
    12:23:11.890836     9237.1848683      :       (06)-------{
    cciSslConvCiphSpec
     12:23:11.890839     9237.1848683      :            Input
    CipherSpec 'RC4_SHA_US                      '
     12:23:11.890844     9237.1848683      :            CipherSpec
    string resolved (RC4_SHA_US                      ) to
    (TLS_RSA_WITH_RC4_128_SHA            ) Hex(05)
     12:23:11.890847     9237.1848683      :            Returning
    protocol 1 (SSL 3.0)
     12:23:11.890849     9237.1848683      :       (06)-------}
    cciSslConvCiphSpec rc=OK FunctionTime=13
     12:23:11.890852     9237.1848683      :            SSL 3.0 CD
    CipherSpec (TLS_RSA_WITH_RC4_128_SHA                )
     ..
     12:23:11.890988     9237.1848683      :       (06)-------{
    rrxError
     12:23:11.890993     9237.1848683      :            RetCode =
    20009631, rc1 = 0, rc2 = 0, Comment1 = 'CHANNEL.NAME ', Comment2
    = 'RC4_SHA_US                      ', Comment3=
    'TLS_RSA_WITH_AES_128_CBC_SHA    ', File=
    '/build/slot1/p900_P/src/lib/comms/amqccisa.c', Line= '2600'
     12:23:11.890998     9237.1848683      :       (06)-------}!
    rrxError rc=rrcE_SSL_UNMATCHED_CIPHERS FunctionTime=10
     12:23:11.890999     9237.1848683      :       (05)------}!
    cciSslCompCiphSpec rc=rrcE_SSL_UNMATCHED_CIPHERS
    FunctionTime=335
    
     Also the connection succeeds when the client application has
    set cipherspec RC4_SHA_US  and the svrconn channel has set
    cipherspec TLS_RSA_WITH_RC4_128_SHA.
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    User of MQ .NET application in managed mode connecting with SSL
    Channel
    
    
    Platforms affected:
    Windows
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    When using the MQ managed .NET client, the CipherSpec
    configuration is defined by the Windows security policy
    configuration. However, if a CipherSpec is supplied by the
    application, this can be used to influence the SSL/TLS protocol
    version in use. A logic error in the MQ managed .NET client mean
    that this protocol selection behaved incorrectly, and for some
    CipherSpec combinations, and incorrect SSL/TLS protocol version
    was proposed to the server.
    

Problem conclusion

  • The  MQ managed .NET client code has been corrected such that
    the correct SSL/TLS protocol version is proposed to the server
    based on the supplied cipherspec.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v8.0       8.0.0.10
    v9.0 LTS   9.0.0.4
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT23995

  • Reported component name

    IBM MQ BASE M/P

  • Reported component ID

    5724H7261

  • Reported release

    900

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-02-08

  • Closed date

    2018-04-19

  • Last modified date

    2018-05-01

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    IBM MQ BASE M/P

  • Fixed component ID

    5724H7261

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"9.0","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
01 May 2018