79518850

Date: 2025-03-19 00:17:18
Score: 2.5
Natty:
Report link

Shouldn't the label be followed by lower case QMName or user normally? E g:
ibmwebspheremqqm1 (sample for server QM1)
ibmwebspheremqmyuser (sample for client MyUser)

I had issues with this and it seems IBM MQ.NET client wants to use TLS 1.0 cipher by default even though it is running on Windows 2019 (client) and Windows 2022 (IBM MQ server) where only TLS 1.2 is enabled in registry. My channel was set to use "ANY_TLS12_OR_HIGHER" also. My application had automatic negotiation so I couldn't change the CipherSpec. I re-enabled TLS 1.0 in registry and I created a new server-connection channel with "ANY" SSL setting and I set these registry keys on both client and server to find out more (I don't recommend to use TLS 1.0 other than during troubleshooting):

AMQ_TLS_V1_ENABLE=1 | TRUE

AMQ_TLS_WEAK_CIPHER_ENABLE=ALL

Then it started to work and by default it was using "TLS_RSA_WITH_AES_256_CBC_SHA" cipher.

You can see the current CipherSpec used on all channels with this command :
-----
runmqsc.exe QM1
DISPLAY CHSTATUS(*) SSLCIPH
-----

I have tested with latest 9.4.0.10 and 9.3.0.27 client versions (Windows 2019) against IBM MQ 9.3.5.0 and 9.4.2.0 servers (Windows 2022).

I also have .NET registry set to use strong crypto, but this includes some more secure TLS 1.0 ciphers as well, so not avoiding TLS 1.0.

My remaining questions:
Why is IBM MQ.NET managed client trying to use the least secure by default?

Why does it try to use TLS 1.0 ciphers when TLS 1.0 server and client are blocked in Windows registry? (HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0)

Why is IBM MQ.NET managed client not negotiating TLS 1.2 connection automatically when my channel SSL is set to "ANY_TLS12_OR_HIGHER"?

Reasons:
  • Long answer (-1):
  • No code block (0.5):
  • Ends in question mark (2):
  • Low reputation (1):
Posted by: r4v3n6