IT41919: Channels fail to start with MQRC_SSL_INITIALIZATION_ERROR (2393)when using TLS1.3 with SSLFIPS(YES)

APAR status

• Closed as program error.

Error description

• Users configuring FIPS TLS1.3 ciphers with SSLFIPS(YES)
  configured on the queue manager will receive an error message
  and the channel will not start.
  
  Out bound connections may receive AMQ9719 errors and MQI Client
  channel connections may receive an MQRC_SSL_INITIALIZATION_ERROR
  (rc=2393).
  
  If ANY_TLS12 or ANY_TLS12_OR_HIGHER is set for the channel, then
  only the TLS 1.2 FIPS allowed ciphers may get configured.
  

Local fix

• Set SSLFIPS(NO) for the queue manager if TLS 1.3 cipherspecs are
  required.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  MQ users requiring TLS1.3 with FIPS mode enabled on a client or
  queue manager.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  MQ blocks using TLS1.3 for FIPS mode (for example, when
  SSLFIPS(YES) is used)
  

Problem conclusion

• TLS1.3 FIPS ciphers are now supported when the queue manager or
  client is running in FIPS mode
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.2 LTS   9.2.0.10
  v9.3 LTS   9.3.0.2
  v9.x CD    9.3.2
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.2

• Fixed component ID

  5724H7281

Applicable component levels