1

We are migrating to WAS 8.5.5 and TLS 1.2 and are observing some unexpected problems.

The inputs are:

  1. Worklight 6.1.0.1
  2. WAS 8.5.5.9 + SDK Java 8
  3. WAS is switched to TLS 1.2 (following this guide https://developer.ibm.com/answers/questions/206952/how-do-i-configure-websphere-application-server-ss.html)

Application is Hybrid

When we use application via web emulator - it works fine.

When we use it from hardware device (Android or iOS) via IMC - we get exception that says

  • "client" uses TLS 1.1
  • server uses TLS 1.2
  • error of HTTPS handshake

It's not clear what is "client" in that case and why it uses TLS v1.1. iOS device (iPhone) web browser is TLS 1.2 enabled - can open HTTPS links with TLS 1.2 protocol. Here is full stack trace from SystemOut.log

[6/14/16 11:16:32:197 EDT] 000000b2 SSLHandshakeE E   SSLC0008E: Unable to initialize SSL connection.  Unauthorized access was denied or security settings have expired.  Exception is javax.net.ssl.SSLHandshakeException: Client requested protocol TLSv1.1 not enabled or not supported
    at com.ibm.jsse2.C.z(C.java:532)
    at com.ibm.jsse2.ap.b(ap.java:476)
    at com.ibm.jsse2.ap.c(ap.java:112)
    at com.ibm.jsse2.ap.wrap(ap.java:277)
    at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:21)
    at com.ibm.ws.ssl.channel.impl.SSLUtils.handleHandshake(SSLUtils.java:748)
    at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.readyInbound(SSLConnectionLink.java:567)
    at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.ready(SSLConnectionLink.java:296)
    at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.sendToDiscriminators(NewConnectionInitialReadCallback.java:214)
    at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.complete(NewConnectionInitialReadCallback.java:113)
    at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
    at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
    at com.ibm.io.async.AsyncChannelFuture$1.run(AsyncChannelFuture.java:205)
    at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1881)
Caused by: javax.net.ssl.SSLHandshakeException: Client requested protocol TLSv1.1 not enabled or not supported
    at com.ibm.jsse2.j.a(j.java:31)
    at com.ibm.jsse2.ap.a(ap.java:11)
    at com.ibm.jsse2.C.a(C.java:342)
    at com.ibm.jsse2.C.a(C.java:100)
    at com.ibm.jsse2.E.a(E.java:140)
    at com.ibm.jsse2.E.a(E.java:813)
    at com.ibm.jsse2.C.r(C.java:44)
    at com.ibm.jsse2.C$b.a(C$b.java:2)
    at com.ibm.jsse2.C$b.run(C$b.java:3)
    at java.security.AccessController.doPrivileged(AccessController.java:686)
    at com.ibm.jsse2.C$c.run(C$c.java:11)
    at com.ibm.ws.ssl.channel.impl.SSLUtils.handleHandshake(SSLUtils.java:835)
    ... 8 more

I have no idea what our next steps should be. Any help will be much appreciated.

2 Answers 2

1

Seems pretty clear that TLSv1.2-only is too aggressive for your clients. In terms of WAS config, "ssl_tlsv2" is probably the best you can do.

1
  • The problem is it is a security requirement to force TLC v 1.2. And using something less restrictive is not an option (at least not the best one) for us. What we want to figure out is what this client is and how it can be forced to use TLS v1.2. Or how we can verify that it can not be achieved.
    – archie_by
    Jun 15, 2016 at 12:40
0

IMC was causing it. Had to configure it to start using TLS v1.2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.