MQ

MQ

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SHA512WithRSA supported?

    Posted Thu August 06, 2020 01:30 PM
    Edited by John Hawkins Thu August 06, 2020 02:18 PM
    Hi Folks,
    I'm stretching my understanding of TLS here...
    I have a 9.1.0.1 QM that's happily sending messages to clients when it instigates the sending connection over TLS using TLS_RSA_WITH_AES_256_CBC_SHA256.
    However, when the reciprocating receiver channel receives in an incoming request is refuses it with AMQ9616E The cipherspec "TLS_RSA_WITH_AES_256_CBC_SHA256" proposed by remote host <hostname  here> is not enabled.

    I'm at a loss as to why it's refusing it ...
    I've replicated it on a 9.1.0 so don't believe it's a  QM version issue.
    I don't believe it's due to the algorithm per se as it refuses other algorithms too including such things as ECDHE_ECDSA_AES_128_GCM_SHA256.
    Both setups (live and test) are that the sender channel is on a different MQ on the same machine i.e. using the same MQ code-base and install so I don't think it's that. (Originally using MQIPT so not that either). I've also set OCSP to warn - just in case.


    The certificate that the server has in it's keydb is using signing algorithm SHA512withRSA.

    I'm beginning to think that this is the problem - but I can't prove it.
    There is a line in the docs that says that the protocols are supported...  (https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.sec.doc/q014260_.htm)

    But there is also this line which doesn't scan well for me - The digital signature algorithm names SHA3WithRSA and SHA5WithRSA are deprecated because they are an abbreviated form of SHA384WithRSA and SHA512WithRSA respectively.
    I don't for sure know what it's telling me - I think it's saying that the key algorithm is fine !? 

    I'm beginning to think that it must be the way the certificate has been generated to be perhaps a TLS v.3 cert - but I can't figure out how to tell if that's true or even if there is such a thing ! It appears to be able to authenticate clients as it has "ClientAuth" and "ServerAuth" extensions. It's key usage is:  digitalSignature, keyAgreement . It may be missing Key encipherment but that doesn't sound right as I have other certs that work as a QM cert and they don't have that.

    I've googled more than I can stand at the moment - anyone got any ideas?

    UPDATE: I've just been told that this was created as ECDH_P256. I can now see that the "public key type" is EC_ecPublicKey but the ones that work for me are RSA.
    I've asked them to recreate them !


    John.


    ------------------------------
    John Hawkins
    Integration Consultant
    ------------------------------


  • 2.  RE: SHA512WithRSA supported?

    Posted Thu August 06, 2020 03:07 PM

    There is a correlation between the CipherSpecs that are available for use and the type of certificate you have.

    Read Digital certificates and CipherSpec compatibility in IBM MQ for more details.

    Cheers,
    Morag



    ------------------------------
    Morag Hughson
    MQ Technical Education Specialist
    MQGem Software Limited
    ------------------------------

    Original Message


  • 3.  RE: SHA512WithRSA supported?

    Posted Thu August 06, 2020 03:27 PM
    Ah ha ! Now I understand that page - Cheers morag!



    Original Message


  • 4.  RE: SHA512WithRSA supported?

    Posted Fri August 07, 2020 08:36 AM
    Edited by FJ Brandelik Fri August 07, 2020 08:37 AM
    Hi John,

    You have to be careful when creating your key. If your key is not an RSA Key, but an Elliptic Curve key, why would you like to try using an RSA cipher?

    ------------------------------
    FJ Brandelik
    ------------------------------

    Original Message


  • 5.  RE: SHA512WithRSA supported?

    Posted Fri August 07, 2020 08:54 AM
    Edited by John Hawkins Fri August 07, 2020 08:55 AM
    I didn't create the key - and I had no idea such a difference existed :-( I do now - which I will put in my back-pocket and treasure for all the other times when I won't need to ;-) 


    For those who find this in years to come... Please be aware that the error you will get is AMQ9616E.
    If you then look in the certificate details (runmqckm -cert -details -db <kdb name> -stashed -label <certificate label>) you will see the line 

    Public Key Type : EC_ecPublicKey (1.2.840.10045.2.1).

    (about half way down)

    This tells you that this is not an RSA key. You can use it with other ciphers but not RSA.
    Either use a non-RSA cipher or get an RSA key type. I hope this post removed some of your pain.




    ------------------------------
    John Hawkins
    Integration Consultant
    ------------------------------

    Original Message