IBM Support

IV46272: WEBSPHERE MQ V7.1 AND V7.5: MQRC_SSL_PEER_NAME_MISMATCH ERROR WHEN CONNECTING TO QUEUE SHARING GROUP.

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When an application using WMQ classes for JMS V7.1 or V7.5
    connects to
    a Queue Sharing Group on zOS, the following error can be seen:
    JMSException linked Exception:
    com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed
    with compcode '2' ('MQCC_FAILED') reason '2398'
    ('MQRC_SSL_PEER_NAME_MISMATCH').
    at com.ibm.msg.client.wmq.common.internal.Reason.createException
    (Reason.java:204)
    at com.ibm.msg.client.wmq.internal.WMQSession.connect
    (WMQSession.java:374)
    at com.ibm.msg.client.wmq.internal.WMQSession.
    (WMQSession.java:282)
    ...
    
    and on zOS side, the following error is seen:
    +CSQX620E =SQ1A CSQXRESP System SSL error
    598              channel        ????
    598              connection host (ip address)
    598              function 'gsk_secure_socket_read' RC=437
    +CSQX228E =SQ1A CSQXRESP Listener unable to start channel,
    599  channel
    599  TRPTYPE=TCP INDISP=GROUP
    .
    Additional symptoms/keywords:
    CSQX209E CSQX228E 5655R3600 5655W9700
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    This issue affects users of:
    
    - The WebSphere MQ v7.1 or 7.5 classes for JMS
    - The WebSphere MQ v7.1 or 7.5 messaging provider inside
    WebSphere Application
    Server
    - The WebSphere MQ v7.1 or 7.5 resource adapter
    
    who attempt to create a JMS connection and
    session using a JMS connection factory which is configured to
    use an SSL
    connection
    to a QSG with two active members, and are using SSLPEER
    filtering
    such that each queue manager in the QSG has a different
    certificate and a different SSLPEER filter
    
    Platforms affected:
    All Distributed (iSeries, all Unix and Windows) +Java +Java zOS
    ****************************************************************
    PROBLEM SUMMARY:
    When an application tried to create an SSL secured JMS
    connection and session to a QSG with two active members, the
    MQRC_SSL_PEER_NAME_MISMATCH error was seen while creating the
    session.
    
    This was because the attempt to create the session reused some
    of the connection details from the parent connection, including
    the SSLPEERNAME property of the connection. If the session
    attempted connection to a different member of the group to the
    parent connection, the the certificate used to secure the
    connection did not match this cached SSLPEERNAME, and so the
    connection was rejected.
    

Problem conclusion

  • The WebSphere MQ classes for JMS have been updated so that the
    SSLPEERNAME property from a JMS connection is no longer
    reused for any child JMS session when a queue sharing group is
    used.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v7.5       7.5.0.4
    v7.1       7.1.0.5
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV46272

  • Reported component name

    WMQ LIN X86 V7

  • Reported component ID

    5724H7224

  • Reported release

    710

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2013-07-30

  • Closed date

    2013-10-30

  • Last modified date

    2016-07-14

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WMQ LIN X86 V7

  • Fixed component ID

    5724H7224

Applicable component levels

[{"Line of Business":{"code":"LOB36","label":"IBM Automation"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSFKSJ","label":"WebSphere MQ"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.1"}]

Document Information

Modified date:
08 March 2021