unixibm-mqsha2

Connection with MQClient 7.5.0 and SHA2

I have a "blackbox" application written in Java that connects to MQ. On unix server there is MQ Client installation version 7.5.0. Java application is using 1.7.0_79. I have to use SSL_RSA_WITH_AES_256_CBC_SHA256 to make the connection.

I cannot upgrade to MQ Client v8. I am not entirely sure if I can connect having MQ Client version 7.5.0 and for instance use SSL_RSA_WITH_AES_256_CBC_SHA256.

Would be that even possible to establish connection having these components ?

Solution

  • IBM added support for non-IBM Java cipher suite names via APAR IV66840, this was included in MQ v7.5.0.5.

    What you are asking should be possible if you have the following:

    1. Set this java system property
      -Dcom.ibm.mq.cfg.useIBMCipherMappings=false
      or
      System.setProperty("com.ibm.mq.cfg.useIBMCipherMappings", "false")
    2. Use cipher suite value TLS_RSA_WITH_AES_256_CBC_SHA256.
      Note does not start with SSL_ for Oracle java.
    3. Make sure the strong cryptographic provider is enable in java to support ciphersuites with AES256 encryption. It appears that if you upgrade to a higher level of java 7 (1.7.0_161 for example) this will be included and enabled by default.
    4. Use a JKS keyStore.