MQ SSL error, protocol is disabled or cipher suites are inappropriate

spring ssl ibm-mq spring-jms jsse
Mark1234 picture Mark1234 · Jul 7, 2015 · Viewed 11.2k times · Source

I have a MQ spring jms application that has been working fine using SSL channel. However after a recent java security patch that was applied the application stopped working with below error.

Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2397' ('MQRC_JSSE_ERROR').
    at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:209) ~[com.ibm.mqjms-7.5.0.0.jar:7.5.0.0 - p000-L120604]
    ... 45 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at sun.security.ssl.Handshaker.activate(Handshaker.java:438) ~[na:1.6.0_34]
        at sun.security.ssl.SSLSocketImpl.kickstartHandshake(SSLSocketImpl.java:1414) ~[na:1.6.0_34]

I notice that the new java security file has this line added that is causing this failure in SSL connection to MQ.

jdk.tls.disabledAlgorithms=SSLv3

I can not get this line removed as this is shared environment, what are my options to make this work. I am using MQQueueConnectionFactory configured and injected into my spring JMS components.

Thank you

Answer

Saikat picture Saikat · May 3, 2016

Can you not use this - java.security.Security.setProperty("jdk.tls.disabledAlgorithms","")

This change was introduced in JDK8.

Related questions

HTTPS login with Spring Security redirects to HTTP

I have a Spring web app, secured with Spring Security, running on EC2. In front of the EC2 instance is an Elastic Load Balancer with an SSL cert (https terminates at the load balancer ie. port 443 -> port 80), so …

Read More
Spring 5 WebClient using ssl

I'm trying to find examples of WebClient use. My goal is to use Spring 5 WebClient to query a REST service using https and self signed certificate Any example?

Read More
trusted certificate entries are not password-protected Spring SAML

I have generated testIdp.cer file by copying 509 entry of the IDP I am planning to connect. Then I created JKS file by executing the following command keytool -importcert -alias adfssigning -keystore C:\Users\user\Desktop\samlKeystore.jks -file C:\…

Read More