Did you bounce the MQTT service / qmgr after changing the SSL Config of the channel? Or at least stop and restart the MTT channel?
Original Message:
Sent: Mon December 11, 2023 06:14 AM
From: Debarpan Mukhopadhyay
Subject: MQTT Connection issue over TLS
Hi Colin,
Thanks for sharing the update and the cipher issue is now resolved after making a change in our MQTT telemetry channel. We have now altered the channel and made the following change to enable 1-Way SSL
DISPLAY CHANNEL('mqtt_sub_storeapp') CHLTYPE(MQTT)
1 : DISPLAY CHANNEL('mqtt_sub_storeapp') CHLTYPE(MQTT)
AMQ8414I: Display Channel details.
CHANNEL(mqtt_sub_storeapp) CHLTYPE(MQTT)
TRPTYPE(TCP) PORT(1807)
LOCLADDR( ) MCAUSER(mqttusrstore)
USECLTID(NO) BACKLOG(4096)
DESCR( )
SSLCIPH(SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
SSLCAUTH(OPTIONAL) SSLKEYP(********)
SSLKEYR(/var/mqm/qmgrs/MQ1SXR01/ssl/mqttservice.sit.hosting.asda.com.jks)
JAASCFG( ) PROTOCOL(MQTTV3,HTTP)
After changing the SSLCAUTH to optional, we are getting the below error from the error log
12/11/23 10:57:32.166 AMQXR0021W: Client '' at network address '192.168.106.1' disconnected abnormally
with exception 'closing inbound before receiving peer's close_notify'.
12/11/23 10:57:32.750 AMQXR0021W: Client '' at network address '192.168.106.1' disconnected abnormally
with exception 'closing inbound before receiving peer's close_notify'.
12/11/23 10:57:33.485 AMQXR0021W: Client '' at network address '192.168.106.1' disconnected abnormally
with exception 'closing inbound before receiving peer's close_notify'.
12/11/23 10:57:34.689 AMQXR0021W: Client '' at network address '192.168.106.1' disconnected abnormally
with exception 'closing inbound before receiving peer's close_notify'.
12/11/23 10:57:38.659 AMQXR0021W: Client '' at network address '192.168.106.1' disconnected abnormally
with exception 'closing inbound before receiving peer's close_notify'
Please find the error log from client end
Failed to Connect MQTT Reciever : mqigw1.sit.hosting.asda.com:1807 log: {"errorCode":7,"errorMessage":"AMQJS0007E Socket error:undefined.","currentURL":"mqigw1.sit.hosting.asda.com:1807"}
<-------------------------------End Of Action------------------------------------->
Can you please let us know why this error is coming? We have checked that the root certificate is present at the client end as well.
Thanks,
Debarpan
------------------------------
Debarpan Mukhopadhyay
Original Message:
Sent: Thu December 07, 2023 03:50 AM
From: Colin Paice
Subject: MQTT Connection issue over TLS
It maybe your certificates are not consistent.
1)Check the server end has SSL_RSA_WITH_AES_128_CBC_SHA256 specified in its list
2)Display the certificate and check it is created with RSA
BTW you are using older (weaker) technology, you should consider moving to cipher specs with *ECDHE* or better in them.
If you can create a wireshark trace of the flow and send it to me (privately) I may be able to see what the problem is
Colin
Original Message:
Sent: 12/6/2023 5:17:00 PM
From: Debarpan Mukhopadhyay
Subject: MQTT Connection issue over TLS
Hi All,
As per the project requirement, One of our client is trying to connect one of our MQTT telemetry channel through TLS protocol and getting the following error
AMQJS0007E Socket error
Also in the MQTT error long we can see the below error
AMQCO1008E: An SSL Handshake error occurred when a client at '/192.168.106.1' attempted to connect to channel 'mqtt_sub_storeapp': javax.net.ssl.SSLHandshakeException: no cipher suites in common.
Please find the channel details below
DISPLAY CHANNEL('mqtt_sub_storeapp') CHLTYPE(mqtt)
3 : DISPLAY CHANNEL('mqtt_sub_storeapp') CHLTYPE(mqtt)
AMQ8414I: Display Channel details.
CHANNEL(mqtt_sub_storeapp) CHLTYPE(MQTT)
TRPTYPE(TCP) PORT(1807)
LOCLADDR( ) MCAUSER(mqttusrstore)
USECLTID(NO) BACKLOG(4096)
DESCR( )
SSLCIPH(SSL_RSA_WITH_AES_128_CBC_SHA256)
SSLCAUTH(NEVER) SSLKEYP(********)
SSLKEYR(/var/mqm/qmgrs/MQ1SXR01/ssl/mqttservice.sit.hosting.asda.com.jks)
JAASCFG( ) PROTOCOL(MQTTV3,HTTP)
In the MQ error log the following error is being shown
AMQCO1008E: An SSL Handshake error occurred when a client at '/192.168.106.1' attempted to connect to channel 'mqtt_sub_storeapp': javax.net.ssl.SSLHandshakeException: no cipher suites in common.
The client is using an external JS file that is mqttws31.js file which created a web socket connection with MQTT server. Below is the code snippet that we are using for creating a web socket connection (Secured & Non secured).
if (this.connectOptions.useSSL)
wsurl = ["wss://", host, ":", port, "/mqtt"].join("");
else
wsurl = ["ws://", host, ":", port, "/mqtt"].join("");
this.connected = false;
this.socket = new WebSocket(wsurl, 'mqttv3.1');
this.socket.binaryType = 'arraybuffer';
Can someone please help me if there is any way to set cipher spec in the java script file that the client is using? Any help on this would be highly appreciated.
Thanks & Regards,
Debarpan
------------------------------
Debarpan Mukhopadhyay
------------------------------