MQQueueManager.<init> 引发 MQJE001：完成代码“2”，指定 MQEnvironment.sslCipherSuite 的原因“2400”

Question

使用以下 sslCipherSuite 创建 MQQueueManager 对象时：

MQEnvironment.sslCipherSuite = "TLS_RSA_WITH_AES_128_CBC_SHA";
MQEnvironment.hostname = host;
MQEnvironment.channel  = channel;
MQEnvironment.port = port;
iMQQueueManager = new MQQueueManager(queueMgr);

it manager init 提出：

MQJE001：完成代码“2”，原因“2400”

这应该意味着“JSSE 报告它不支持应用程序指定的 CipherSuite”(http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.5.0/com.ibm.mq.tro.doc/q044280_.htm)

我已将队列管理器 -> 通道（属性）-> SSL -> CipherSpec 配置为：TLS_RSA_WITH_AES_128_CBC_SHA（TLS 1.0，安全散列算法，128 位 AES 加密）。

使用的平台是：

JAVA 7 (1.7.0_75-b13) 
MQ 7.1 client libs (7.1.0.6-k710-006-141112)
MQ 8.0 server (8.0.0.5)

这里是堆栈详细信息：

Exception in thread "main" com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2400'.
    at com.ibm.mq.MQManagedConnectionJ11.constructMQCD(MQManagedConnectionJ11.java:1434)
    at com.ibm.mq.MQManagedConnectionJ11.constructCNO(MQManagedConnectionJ11.java:1537)
    at com.ibm.mq.MQManagedConnectionJ11.<init>(MQManagedConnectionJ11.java:233)
    at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:588)
    at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:630)
    at com.ibm.mq.StoredManagedConnection.<init>(StoredManagedConnection.java:107)
    at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:205)
    at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:911)
    at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:799)
    at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:750)
    at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:157)
    at com.ibm.mq.MQQueueManager.<init>(MQQueueManager.java:681)

我猜问题出在 MQ 配置方面，因为我的 jre

SSLContext.getInstance("TLS")
.init(null, trustAllCerts, new SecureRandom())
.getSupportedSSLParameters()
.getCipherSuites()

返回“TLS_RSA_WITH_AES_128_CBC_SHA”作为 CipherSuites 之一。但我不确定 QMgr 配置到底出了什么问题。感谢您的任何提示。

Answer 1

您应该阅读以下 2 个 IBM MQ 公告：

• http://www-01.ibm.com/support/docview.wss?uid=swg21688165
• http://www-01.ibm.com/support/docview.wss?uid=swg21688165

Answer 2

当我仅过滤 SSL/TLS CipherSpecs and CipherSuites in IBM MQ classes for JMS 中列出的 MQ 支持的密码时

并检查所有 Java 版本：1.7.0_75 支持的密码通过上面链接支持的 MQ 过滤，我收到以下结果：

public class SSLSupported {

    // http://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.dev.doc/q113220_.htm
    static String[] MQ_SUPPORTED = { "SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "SSL_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "SSL_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "SSL_ECDHE_ECDSA_WITH_NULL_SHA",
            "SSL_ECDHE_ECDSA_WITH_RC4_128_SHA",
            "SSL_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
            "SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
            "SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "SSL_ECDHE_RSA_WITH_NULL_SHA", 
            "SSL_ECDHE_RSA_WITH_RC4_128_SHA",
            "SSL_RSA_EXPORT_WITH_RC4_40_MD5",
            "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA",
            "SSL_RSA_FIPS_WITH_DES_CBC_SHA", 
            "SSL_RSA_WITH_3DES_EDE_CBC_SHA",
            "SSL_RSA_WITH_AES_128_CBC_SHA", 
            "SSL_RSA_WITH_AES_128_CBC_SHA256",
            "SSL_RSA_WITH_AES_128_GCM_SHA256", 
            "SSL_RSA_WITH_AES_256_CBC_SHA",
            "SSL_RSA_WITH_AES_256_CBC_SHA256",
            "SSL_RSA_WITH_AES_256_GCM_SHA384", 
            "SSL_RSA_WITH_DES_CBC_SHA",
            "SSL_RSA_WITH_NULL_MD5", 
            "SSL_RSA_WITH_NULL_SHA",
            "SSL_RSA_WITH_NULL_SHA256", 
            "SSL_RSA_WITH_RC4_128_MD5",
            "SSL_RSA_WITH_RC4_128_SHA" };

    public static void main(String[] args) throws NoSuchAlgorithmException, KeyManagementException {
        // Create an SSLContext that uses our TrustManager
        SSLContext context = SSLContext.getInstance("TLS");
        TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return null;
            }

            public void checkClientTrusted(X509Certificate[] certs,
                    String authType) {
            }

            public void checkServerTrusted(X509Certificate[] certs,
                    String authType) {
            }

        } };

        context.init(null, trustAllCerts, new SecureRandom());

        SSLParameters params = context.getSupportedSSLParameters();
        String[] suites = params.getCipherSuites();
        System.out.println("Java version : " + System.getProperty("java.runtime.version"));
        System.out.println("Connecting with " + suites.length + " cipher suites supported:");

        List<String> mqSupported= Arrays.asList(MQ_SUPPORTED);

        for (int i = 0; i < suites.length; i++) 
            if (mqSupported.contains(suites[i])) 
                System.out.println(suites[i]);

    }

}

Java version : 1.7.0_75-b13
Connecting with 63 cipher suites supported:
SSL_RSA_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_WITH_NULL_SHA
SSL_RSA_WITH_NULL_MD5

我使用了以下密码套件：

MQEnvironment.sslCipherSuite = "SSL_RSA_WITH_3DES_EDE_CBC_SHA"

问题是 MQ QueueManager 将上述所有这些都报告为“Weak CipherSpec”，例如：

（警告 Weak CipherSpec）SSL 3.0，安全散列算法，168 位三重 DES 加密

所以我不得不在 MQ 安装中进行配置更改： [mq.ini]

SSL:
AllowSSLV3=Y
AllowWeakCipherSpec=ALL

还有（正如Roger 注意到的his response）： [java.security]

#   jdk.tls.disabledAlgorithms=SSLv3

它开始通过 TLSv1 进行通信，但我想使用 TLSv1.2 密码，但它仍然无法正常工作，我使用了 Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files (jre7) 以及：

SSLContext context = SSLContext.getInstance("TLSv1.2");
SSLContext.setDefault(context);

或

MQEnvironment.sslSocketFactory = new SSLSocketFactoryEx();

this 发布的 SSLSocketFactoryEx 实现。

但没有什么好用的，所以我仍在使用 TLSv1。