0

We are doing an integration between websphere and a TLSv1.2 system and it is throwing handshake exception because of the cipher mismatch [certificate and client side tls versions matching]. We have added the required cipher to the server [SSL_RSA_WITH_AES_128_GCM_SHA256] but it is not showing in the logs. so the handshake is failed. [as per the destination system network team, all the below listed ciphers are of tlsv1 so it cannot be added to their server]

From SSL logs: Cipher Suites: [SSL_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RENEGO_PROTECTION_REQUEST]

What could be the reason for this ?

is there any way we can add this required cipher from java code?

Thanks in advance

1 Answer 1

0

Where did you add the cipher? Inside QoP? The cipher SSL_RSA_WITH_AES_128_GCM_SHA256 is disabled by default - I think by adding this to the server may not work. Try adding the custom property com.ibm.websphere.tls.disabledAlgorithms=none.

3
  • Yes I have added that to QoP. I assume your suggesion is to keep the cipher in QoP and add this additional custom propery. I will try that. Thanks a lot for this.
    – Sree
    Mar 25, 2019 at 2:28
  • I have added this and that dint resolve the issue. And i searched for this cipher[SSL_RSA_WITH_AES_128_GCM_SHA256 ] in full logs for the last few days and I can see that in the cipher list for some other service connections. So now I am totally confused why it is not coming for this specific service. I made the REST client call similar to all the other services also..
    – Sree
    Mar 25, 2019 at 4:23
  • I want to ask where did you add the custom property? under JVM or Global Security? Mar 28, 2019 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.