IBM Support

IT35078: Improve error message when a certificate does not meet key length requirements

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • If an attempt was made to establish a TLS connection using a
    certificate with an insufficient key length, a generic AMQ9620E
    error was reported in the MQ error log.
    
    The AMQ9620E reports "Internal error on call to SSL function",
    with error code '457'.
    
    This APAR improves this message to highlight the root cause to
    the user.
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    Users of MQ with TLS-protected channels.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    The generic AMQ9620E message did not provide sufficient clarity
    to the user in this scenario.
    

Problem conclusion

  • In the scenario where a certificate's key length is
    insufficient, the error log will now report either AMQ9633E (if
    the remote peer certificate is at fault) or AMQ9797E (if the
    local certificate is at fault). The explanations of these
    messages have been updated to describe this scenario.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v9.1 LTS   9.1.0.8
    v9.2 LTS   9.2.0.2
    v9.x CD    9.2.2
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT35078

  • Reported component name

    IBM MQ BASE MP

  • Reported component ID

    5724H7271

  • Reported release

    910

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-11-27

  • Closed date

    2021-01-22

  • Last modified date

    2021-01-22

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    IBM MQ BASE MP

  • Fixed component ID

    5724H7271

Applicable component levels

[{"Line of Business":{"code":"LOB36","label":"IBM Automation"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"910"}]

Document Information

Modified date:
23 January 2021