WMQ JMS API SSL Sun JDK 和 SSL_RSA_WITH_AES_128_CBC_SHA

Question

如何让 JMS 客户端使用 SSL_RSA_WITH_AES_128_CBC_SHA（在队列连接工厂中）连接到使用 TLS_RSA_WITH_AES_128_CBC_SHA 的服务器

• 客户端 Sun JDK 7 获胜
• 服务器 IBM Power (i)
• 服务器上的 MQ 版本 7.1
• 客户端上的MQ版本7.5.0.4
• 与 MQ Explorer 的连接工作正常
• 以下代码适用于 ibm JDK C:\Program Files\IBM\WebSphere MQ Explorer\jre\jre\bin
• 以下代码不适用于“C:\Program Files\Java\jdk1.7.0_67\bin with Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 7 Download installed”

代码：

       // Instantiate the initial context
        String contextFactory = "com.sun.jndi.fscontext.RefFSContextFactory";
        Hashtable environment = new Hashtable();
        environment.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);
        environment.put(Context.PROVIDER_URL, initialContextUrl);
        Context context = new InitialDirContext(environment);
        System.out.println("Initial context found!");

        String keystoreName = System.getProperty("javax.net.ssl.keyStore");
        System.out.println("keystoreName " + keystoreName + " canRead " + new File(keystoreName).canRead());
        String truststoreName = System.getProperty("javax.net.ssl.trustStore");
        System.out.println("truststoreName " + keystoreName + " canRead " + new File(truststoreName).canRead());


        // Lookup the connection factory
        JmsConnectionFactory cf = (JmsConnectionFactory) context.lookup(connectionFactoryFromJndi);


        System.out.println("CF = " + cf.getClass().getName());

        MQConnectionFactory mqcf = (MQConnectionFactory) cf;
        System.out.println("getSSLCipherSuite:" + mqcf.getSSLCipherSuite());
        System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());

        // Lookup the destination
        destination = (JmsDestination) context.lookup(destinationFromJndi);
        System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());

        // Create JMS objects
        connection = cf.createConnection();
        System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());

        session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
        System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());

        consumer = session.createConsumer(destination);
        System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());

        // Start the connection

        connection.start();
        System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());

给我：

 Initial context found!
keystoreName C:/Users/...key.jks canRead true
truststoreName C:/Users/.../key.jks canRead true
CF = com.ibm.mq.jms.MQConnectionFactory
getSSLCipherSuite:SSL_RSA_WITH_AES_128_CBC_SHA
getSSLSocketFactory:null
getSSLSocketFactory:null
keyStore is : C:/Users/.../key.jks
keyStore type is : jks
keyStore provider is : 
init keystore
init keymanager of type SunX509
***
found key for : ibmwebspheremquserid
.....
  Valid from Mon May 14 23:59:46 CEST 2012 until Thu May 14 23:59:46 CEST 2015

trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
com.ibm.msg.client.jms.DetailedJMSException: JMSWMQ0018: Failed to connect to queue manager 'qm' with connection mode 'Client' and host name 'host(1414)'.
Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information.
Inner exception(s):
com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2393' ('MQRC_SSL_INITIALIZATION_ERROR').
com.ibm.mq.jmqi.JmqiException: CC=2;RC=2393;AMQ9204: Connection to host 'host(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Unsupported ciphersuite SSL_RSA_WITH_AES_128_CBC_SHA],3=host/host:1414 (10.20.28.12),4=SSLSocket.createSocket,5=default]],3=host(1414),5=RemoteTCPConnection.makeSocketSecure]
com.ibm.mq.jmqi.JmqiException: CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Unsupported ciphersuite SSL_RSA_WITH_AES_128_CBC_SHA],3=host/host:1414 (10.20.28.12),4=SSLSocket.createSocket,5=default]
java.lang.IllegalArgumentException: Unsupported ciphersuite SSL_RSA_WITH_AES_128_CBC_SHA
FAILURE

Answer 1

切换到 IBM JRE/JDK 就可以了。

Answer 2

从 Oracle JVM (JSSE) 使用 SSL

另见“What TLS cipherspecs/ciphersuites are supported when connecting from Oracle Java (non-IBM JRE) to MQ queue manager?”

在 MQ 客户端版本 8.0.0.2 中包含一个补丁以将 TLS 与 Oracle JVM 一起使用，这适用于上面的 lanes 答案

要让它工作，你需要最新的 MQ 客户端，它包含 IV66840: WMQ V7 JAVA/JMS: 添加对选定 TLS 密码规范的支持 在非 IBM JAVA 运行时环境中运行
http://www-01.ibm.com/support/docview.wss?uid=swg1IV66840
(download)

根据您所在的位置，您可能还需要安装 Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 (download)

要使用它，您必须使用 JVM 参数进行配置：

  -Dcom.ibm.mq.cfg.useIBMCipherMappings=false

注意Oracle和IBM JVM之间默认的安全实现行为differs：

Oracle JSSE Reference guide 说：

如果 KeyManager[] 参数为空，那么一个空的 KeyManager 将 为这个上下文定义。

IBM JSSE Reference guide 说：

如果 KeyManager[] 参数为空，则安装的安全 提供者将被搜索最高优先级的实现 KeyManagerFactory，一个合适的 KeyManager 将从那里得到 获得。

这意味着你必须设置your own ssl context

SSLContext  sslcontext = SSLContext.getInstance("TLS");
String  keyStore = System.getProperty("javax.net.ssl.keyStore");
String  keyStoreType = System.getProperty("javax.net.ssl.keyStoreType", KeyStore.getDefaultType());
String  keyStorePassword = System.getProperty("javax.net.ssl.keyStorePassword","");
KeyManager[]    kms = null;
if (keyStore != null)
{
    KeyManagerFactory   kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    KeyStore    ks = KeyStore.getInstance(keyStoreType);
    if (keyStore != null && !keyStore.equals("NONE")) {
        fs = new FileInputStream(keyStore);
    ks.load(fs, keyStorePassword.toCharArray());
    if (fs != null)
        fs.close();
    char[]  password = null;
    if (keyStorePassword.length() > 0)
        password = keyStorePassword.toCharArray();
    kmf.init(ks,password);
    kms = kmf.getKeyManagers();
}
sslcontext.init(kms,null,null);

然后将其提供给 MQ JMS 客户端：

    JmsConnectionFactory cf = ...                                                                     

    MQConnectionFactory mqcf = (MQConnectionFactory) cf;              
    mqcf.setSSLSocketFactory(sslcontext.getSocketFactory());  

如果使用应用程序服务器，这可能由您的应用程序服务器处理。