Question for Connecting to IBM MQ using TLS13

[UlrichLohrmann]

We use Open Liberty 25.0.0.9 witj Jakarta EE and IBM MQ JCA Ressource adapter version 9.3.0.3.
The resource connector ist loaded using

<resourceAdapter id="mqjms" location="${mqJmsClient.jakarta.rar.location.9.3.0.3}"> <properties.mqjms reconnectionRetryCount="480" reconnectionRetryInterval="60000"/> </resourceAdapter>
A message driven bean is connected to a queue using the following code snipet

<jmsActivationSpec id="..." authDataRef="..."> <properties.mqjms destinationType="jakarta.jms.Queue" channel="..." hostName="..." port="..." queueManager="..." destinationRef="..." sslCipherSuite="TLS_RSA_WITH_AES_256_CBC_SHA256" maxPoolDepth="1"/> </jmsActivationSpec>
Everything works fine so far.

Now we have created a new MQ Channel "TLS13CHANNEL" in the MQ Server. This channel uses a configuration of "TLS13_OR_HIGHER" in it's SSL setting.

My question: Which value do I have to use in the Element instead of "TLS_RSA_WITH_AES_256_CBC_SHA256"? I would prefer not to specify any cipher and let the underlying TLS layer select one but that seems not to work. If I specify a valid TLS13 cipher like "TLS_AES_128_GCM_SHA256" no error occurs but as I mentioed I would prefer not to specify any concrete cipher. Is that possible? If yes, how?

Best regards
Ulrich

[sakerl]

The sslCipherSuite property is a property defined in the IBM MQ Resource Adapter (listed at https://www.ibm.com/docs/en/ibm-mq/9.3.x?topic=adapter-configuring-resource-inbound-communication)
So, the valid values for that properties are the ones accepted in the RA and are listed at: https://www.ibm.com/docs/en/ibm-mq/9.3.x?topic=jms-tls-cipherspecs-ciphersuites-in-mq-classes

[UlrichLohrmann]

@sakerl Thank you for your fast reply.

When I use "ANY_TLS13_OR_HIGHER" as a value for the sslCipherSuite property, I get the MQ error message

JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2400' ('MQRC_UNSUPPORTED_CIPHER_SUITE').

When I use "*TLS13ORHIGHER" I get the error

java.lang.IllegalArgumentException: Unsupported CipherSuite: *TLS13ORHIGHER

from JDK's TLS protocol stack.

Same with value "*TLS13".

java.lang.IllegalArgumentException: Unsupported CipherSuite: *TLS13

So to me it seems that none of the "alias-cipher" work.

Additional information: I also have the following MQ related properties set:
-Dcom.ibm.mq.cfg.preferTLS=true
-Dcom.ibm.mq.cfg.useIBMCipherMappings=false

I use Temurin JDK-17, version 17.0.18+8.

Best regards
Ulrich