【发布时间】：2017-06-10 17:26:56
【问题描述】：
我们已启用 SSL
- MQ 版本“7.1.0.7”
- 操作系统->'Linux 2.6.32-642.11.1.el6.x86_64'
- 两个月前 [2016 年 8 月]，它在启用和禁用 SSL 模式下工作正常
Java 客户端使用
- jdk1.7.0_21
- 工作密码/套件 ->
SSL_RSA_WITH_RC4_128_SHA <> RC4_SHA_US
当我尝试连接到 MQ v7.1.0.7 队列管理器时，应用程序抛出以下错误：
com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2397'.
at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:228)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:553)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:593)
at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:95)
at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:198)
at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:882)
在队列管理器错误日志AMQERR01.LOG 我看到了这个：
AMQ9616: The CipherSpec proposed is not enabled on the server.
EXPLANATION: The SSL or TLS subsystem at the server end of a channel
been configured in such a way that it has rejected the CipherSpec
proposed by an SSL or TLS client. This rejection occurred during the
secure socket handshake (i.e. it happened before the proposed
CipherSpec was compared with the CipherSpec in the server channel
definition).
我们有一个 MQ v6.0.2.12 队列管理器，它运行良好。
有人可以帮助解决以前工作的系统出了什么问题吗？
通过在 qm.ini 文件中添加以下行解决
SSL:
AllowSSLV3=Y
AllowWeakCipherSpec=Y
更新（2017 年 1 月 27 日）有其他问题：
工作于 TLSv1
TLS_RSA_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA TLSv1 TRUETLS_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA TLSv1 TRUE
TLSv1.2
失败TLS_RSA_WITH_RC4_128_SHA256 SSL_RSA_WITH_RC4_128_SHA TLSv1.2 FALSE
我尝试了以下设置：
-
SSLContext sslContext = SSLContext.getInstance("TLSv1"); -Dcom.ibm.mq.cfg.preferTLS=true-Dcom.ibm.mq.cfg.useIBMCipherMappings=false
错误是com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2397'
在AMQERR01.LOG
There is a mismatch between the CipherSpecs on the local and remote ends
of channel 'TEST.CH'. The channel will not run until this mismatch is
resolved.The CipherSpec required in the local channel definition is
'TLS_RSA_WITH_RC4_128_SHA256'. The name of the CipherSpec negotiated during
the SSL handshake is 'RC4_SHA_US'. A code is displayed if the name of the
negotiated CipherSpec cannot be determined
更新（2017 年 1 月 29 日）有其他问题：
SSLContext sslContext = SSLContext.getInstance("TLSv1.2");MQEnvironment.sslFipsRequired = true;MQEnvironment.sslCipherSuite ="SSL_RSA_WITH_AES_256_CBC_SHA256";ALTER CHANNEL(TEST.CH) CHLTYPE(SVRCONN) SSLCIPH(TLS_RSA_WITH_AES_256_CBC_SHA256)REFRESH SECURITY TYPE(SSL)- 客户端执行
/apps/java/jdk1.7.0_21/bin/java -Dcom.ibm.mq.cfg.preferTLS=true -Dcom.ibm.mq.cfg.useIBMCipherMappings=false -classpath .:/tmp/mqssl/com.ibm.mq.jmqi.jar:/tmp/mqssl/com.ibm.mq.jar:com.ibm.ws.webservices.thinclient_8.5.0.jar MQProducerSSL
收到错误MQJE001: Completion Code '2', Reason '2400'
MQRC_UNSUPPORTED_CIPHER_SUITE (2400)
更新（2017 年 1 月 30 日）有其他问题：
仍然是同样的错误，但在我的客户端 java prg 已启用 System.setProperty("javax.net.debug", "all"); 以在执行客户端时查看所有活动。其打印TLS_RSA_WITH_AES_256_CBC_SHA256 为Ignoring unavailable cipher suite 如下
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
通话前
MQJE001: Completion Code '2', Reason '2400'.
MQJE001: Completion Code '2', Reason '2400'.
使用 IBM-JDK-71 测试相同的异常
SSL_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHAECDHE_ECDSA_3DES_EDE_CBC_SHA256
SSL_ECDHE_RSA_WITH_NULL_SHAECDHE_RSA_NULL_SHA256
更新（2017 年 1 月 31 日）有其他问题：
com.ibm.mq.jar
Specification-Version: 7.1.0.1
Specification-Vendor: IBM Corporation
Implementation-Title: WebSphere MQ classes for Java
Implementation-Version: 7.1.0.1 - k710-001-120424
com.ibm.mq.jmqi.jar
Specification-Version: 7.1.0.1
Specification-Vendor: IBM Corporation
Implementation-Title: WebSphere MQ Interface for Java
Implementation-Version: 7.1.0.1 - k710-001-120424
更新（2017 年 1 月 31 日 A）有其他问题：
由于 MQ 和客户端在同一台机器上运行，因此通过更改类路径获得了 Specification-Version: 7.1.0.7 jar
使用 2 个场景完成测试
-
没有
-Dcom.ibm.mq.cfg.useIBMCipherMappings=false
jdk1.7.0_21/bin/java -Dcom.ibm.mq.cfg.preferTLS=true -classpath .:/opt/mqm/java/lib/com.ibm.mq.jmqi.jar:/opt/mqm/java/lib/com.ibm.mq.jar MQProducerSSL
遇到异常MQJE001: Completion Code '2', Reason '2400'
-
与
-Dcom.ibm.mq.cfg.useIBMCipherMappings=false
/apps/hostlink/java/jdk1.7.0_21/jdk1.7.0_21/bin/java -Dcom.ibm.mq.cfg.preferTLS=true -Dcom.ibm.mq.cfg.useIBMCipherMappings=true -classpath .:/opt/mqm/java/lib/com.ibm.mq.jmqi.jar:/opt/mqm/java/lib/com.ibm.mq.jar MQProducerSSL
遇到异常MQJE001: Completion Code '2', Reason '2393'
com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2393'.
at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:232)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:553)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:593)
at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:96)
at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:198)
at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:893)
at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:780)
at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:729)
at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:177)
at com.ibm.mq.MQQueueManager.<init>(MQQueueManager.java:674)
at MQProducerSSL.main(MQProducerSSL.java:89)
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2393;AMQ9204: Connection to host 'localhost(2017)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Cannot support TLS_RSA_WITH_AES_256_CBC_SHA256 with currently installed providers],3=localhost/127.0.0.1:2017 (localhost),4=SSLSocket.createSocket,5=default]],3=localhost(2017),5=RemoteTCPConnection.makeSocketSecure]
更新 (2017/01/31 B) 有其他问题：
MQEnvironment.sslFipsRequired = false;
MQEnvironment.sslCipherSuite = "TLS_RSA_WITH_AES_128_CBC_SHA256";
ALTER CHANNEL(TEST.CH) CHLTYPE(SVRCONN) SSLCIPH(TLS_RSA_WITH_AES_128_CBC_SHA256)
/apps/hostlink/java/jdk1.7.0_21/jdk1.7.0_21/bin/java -Dcom.ibm.mq.cfg.preferTLS=true -Dcom.ibm.mq.cfg.useIBMCipherMappings=false -classpath .:/opt/mqm/java/lib/com.ibm.mq.jmqi.jar:/opt/mqm/java/lib/com.ibm.mq.jar MQProducerSSL
MQJE001：完成代码“2”，原因“2397”。
MQJE001: Completion Code '2', Reason '2397'.
com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2397'.
at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:232)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:553)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:593)
at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:96)
at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:198)
at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:893)
at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:780)
at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:729)
at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:177)
at com.ibm.mq.MQQueueManager.<init>(MQQueueManager.java:674)
at MQProducerSSL.main(MQProducerSSL.java:89)
在 TLSv1 下工作
----规格----TLS_RSA_WITH_DES_CBC_SHA
---套房----SSL_RSA_WITH_DES_CBC_SHA
TLSv1 正确
Not working , when given below parameters , throwing **MQJE001: Completion Code '2', Reason '2400'**
-Dcom.ibm.mq.cfg.useIBMCipherMappings=false
-Dcom.ibm.mq.cfg.preferTLS=true
怀疑TLSv1，如果TLSv1在没有上述参数的情况下工作，为什么需要为TLSv2提供-Dcom.ibm.mq.cfg.preferTLS=true？
即使使用 IBM-JDK 7.1，TLSv2 也无法正常工作，可能是什么问题？
需要试用 MQ8 吗？
更新（2017 年 2 月 1 日），增加了一些问题：
控制台中的完全异常
MQJE001: Completion Code '2', Reason '2397'.
com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2397'.
at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:232)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:553)
at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:593)
at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:96)
at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:198)
at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:893)
at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:780)
at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:729)
at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:177)
at com.ibm.mq.MQQueueManager.<init>(MQQueueManager.java:674)
at MQProducerSSL.main(MQProducerSSL.java:89)
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host 'localhost(2017)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Error signing certificate verify],3=localhost/127.0.0.1:2017 (localhost),4=SSLSocket.startHandshake,5=default]],3=localhost(2017),5=RemoteTCPConnection.protocolConnect]
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:2098)
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1347)
at com.ibm.mq.MQSESSION.MQCONNX_j(MQSESSION.java:924)
at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:221)
... 10 more
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Error signing certificate verify],3=localhost/127.0.0.1:2017 (localhost),4=SSLSocket.startHandshake,5=default]
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1310)
at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:714)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:356)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:265)
at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:144)
at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1709)
... 13 more
Caused by: javax.net.ssl.SSLHandshakeException: Error signing certificate verify
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1886)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)
at sun.security.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:987)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:285)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1280)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1273)
at java.security.AccessController.doPrivileged(Native Method)
at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1271)
... 18 more
Caused by: java.security.NoSuchAlgorithmException: SHA224withRSA Signature not available
at java.security.Signature.getInstance(Signature.java:224)
at sun.security.ssl.JsseJce.getSignature(JsseJce.java:241)
at sun.security.ssl.HandshakeMessage$CertificateVerify.<init>(HandshakeMessage.java:1552)
at sun.security.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:982)
... 29 more
来自 AMKERR01.LOG
----- amqrmrsa.c : 930 --------------------------------------------------------
01/31/2017 08:45:00 PM - Process(14444.328) User(mqm) Program(amqrmppa)
Host(testvm) Installation(Installation1)
VRMF(7.1.0.7) QMgr(TLSTEST.QM)
AMQ9665: SSL connection closed by remote end of channel '????'.
EXPLANATION:
The SSL or TLS connection was closed by the remote host 'localhost (127.0.0.1)'
during the secure socket handshake. The channel is '????'; in some cases its
name cannot be determined and so is shown as '????'. The channel did not start.
ACTION:
Check the remote end of the channel for SSL and TLS errors. Fix them and
restart the channel.
----- amqccisa.c : 6478 -------------------------------------------------------
01/31/2017 08:45:00 PM - Process(14444.328) User(mqm) Program(amqrmppa)
Host(testvm) Installation(Installation1)
VRMF(7.1.0.7) QMgr(TLSTEST.QM)
AMQ9492: The TCP/IP responder program encountered an error.
EXPLANATION:
The responder program was started but detected an error.
The host name was 'localhost (127.0.0.1)'; in some cases the host name cannot
be determined and so is shown as '????'.
ACTION:
Look at previous error messages in the error files to determine the error
encountered by the responder program.
----- amqrmrsa.c : 930 --------------------------------------------------------
从 classpath 中删除了旧的 jar，但仍然是相同的异常
控制台输出为算法打印以下行
matching alias: ibmwebspheremqtlstest.qm
*** Certificate chain
chain [0] = [
[
Version: V3
Signature Algorithm: SHA1withRSA,
在客户端，传递 key.jks 文件，该文件是在 MQ 级别使用“runmqckm”创建的
是否需要为 TLSv2 指定不同的创建算法？
TLSV2 适用于 JDK8 和 ibm/java-x86_64-71
SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
Oracle JDK8
MQEnvironment.sslFipsRequired = false;
MQEnvironment.sslCipherSuite = "TLS_RSA_WITH_AES_128_CBC_SHA256";
ALTER CHANNEL(TEST.CH) CHLTYPE(SVRCONN) SSLCIPH(TLS_RSA_WITH_AES_128_CBC_SHA256)
IBM-JDK 7.1
MQEnvironment.sslFipsRequired = false;
MQEnvironment.sslCipherSuite = "SSL_RSA_WITH_NULL_SHA256";
ALTER CHANNEL(TEST.CH) CHLTYPE(SVRCONN) SSLCIPH(TLS_RSA_WITH_NULL_SHA256)
但是关于的问题如何使用低于 8 的 Oracle java 版本使用任何 TLSv2 密码？
要解决/解决问题：将一一尝试
1) 使用 IBM JVM
2) 使用 Oracle Java v8 进行测试
3) 尝试 MQ v8
4) 设置SSLCAUTH=OPTIONAL 的其他选项，不需要客户端证书。
尝试使用 JDK8 和 MQ8
现在尝试对已安装的 JDK8 + MQ8、MQServer8 和 MQSeriesGSKit-8.0.0-4.x86_64 执行相同操作，但现在使用 runmqckm 命令创建证书时出现问题
export LD_LIBRARY_PATH=/opt/mqm/gskit8/lib64
export PATH=$PATH:/opt/mqm/gskit8/bin
runmqckm
bash: runmqckm: command not found
部分使用 runmqakm
但未能创建如下的 jks 文件
runmqakm -keydb -create -db /var/mqm/qmgrs/TLSTEST\!QM/ssl/key.jks -pw password -type jks
CTGSK3017W The database type "jks" is not recognized.
已解决
路径下方不需要设置
export LD_LIBRARY_PATH=/opt/mqm/gskit8/lib64
export PATH=$PATH:/opt/mqm/gskit8/bin
【问题讨论】：