title: Using SSL support for Java clients & WebSphere MQ
body: <p>I am trying to connect to IBM MQ using a Java client.I have setup the necessary keydatabase,keystore and truststore files following the below tutorial.</p>
  
  <blockquote>
    <p><a href="https://qadeer786.wordpress.com/2013/10/08/using-ssl-support-for-java-clients-websphere-mq/" rel="nofollow noreferrer">https://qadeer786.wordpress.com/2013/10/08/using-ssl-support-for-java-clients-websphere-mq/</a></p>
  </blockquote>
  
  <p>When I run the Java client it gives me the following error.</p>
  
  <pre><code>com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2397'.
      at com.ibm.mq.MQManagedConnectionJ11.&lt;init&gt;(MQManagedConnectionJ11.java:249)
      at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:450)
      at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:487)
      at com.ibm.mq.StoredManagedConnection.&lt;init&gt;(StoredManagedConnection.java:97)
      at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:194)
      at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:868)
      at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:816)
      at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:758)
      at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:200)
      at com.ibm.mq.MQQueueManager.&lt;init&gt;(MQQueueManager.java:682)
      at esb.wso2.org.client.MQConnectionBuilder.&lt;init&gt;(MQConnectionBuilder.java:52)
      at esb.wso2.org.client.MQConnectionBuilder.getInstance(MQConnectionBuilder.java:60)
      at esb.wso2.org.client.MQProducer.&lt;init&gt;(MQProducer.java:20)
      at esb.wso2.org.client.MQClient.main(MQClient.java:7)
  Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host '127.0.0.1(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Remote host closed connection during handshake],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.startHandshake,5=default]],3=127.0.0.1(1414),5=RemoteTCPConnection.protocolConnect]
      at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:2282)
      at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1294)
      at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJmqiImpl.java:376)
      at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:560)
      at com.ibm.mq.MQSESSION.MQCONNX_j(MQSESSION.java:916)
      at com.ibm.mq.MQManagedConnectionJ11.&lt;init&gt;(MQManagedConnectionJ11.java:235)
      ... 13 more
  Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Remote host closed connection during handshake],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.startHandshake,5=default]
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1329)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:863)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:409)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:305)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:146)
      at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1730)
      ... 18 more
  Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:992)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1298)
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1290)
      at java.security.AccessController.doPrivileged(Native Method)
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1290)
      ... 23 more
  Caused by: java.io.EOFException: SSL peer shut down incorrectly
      at sun.security.ssl.InputRecord.read(InputRecord.java:505)
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
      ... 30 more
  com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2397'.
      at com.ibm.mq.MQManagedConnectionJ11.&lt;init&gt;(MQManagedConnectionJ11.java:249)
      at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:450)
      at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:487)
      at com.ibm.mq.StoredManagedConnection.&lt;init&gt;(StoredManagedConnection.java:97)
      at com.ibm.mq.MQSimpleConnectionManager.allocateConnection(MQSimpleConnectionManager.java:194)
      at com.ibm.mq.MQQueueManagerFactory.obtainBaseMQQueueManager(MQQueueManagerFactory.java:868)
      at com.ibm.mq.MQQueueManagerFactory.procure(MQQueueManagerFactory.java:816)
      at com.ibm.mq.MQQueueManagerFactory.constructQueueManager(MQQueueManagerFactory.java:758)
      at com.ibm.mq.MQQueueManagerFactory.createQueueManager(MQQueueManagerFactory.java:200)
      at com.ibm.mq.MQQueueManager.&lt;init&gt;(MQQueueManager.java:682)
      at esb.wso2.org.client.MQConnectionBuilder.getQueueManager(MQConnectionBuilder.java:68)
      at esb.wso2.org.client.MQProducer.&lt;init&gt;(MQProducer.java:22)
      at esb.wso2.org.client.MQClient.main(MQClient.java:7)
  Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9204: Connection to host '127.0.0.1(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Remote host closed connection during handshake],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.startHandshake,5=default]],3=127.0.0.1(1414),5=RemoteTCPConnection.protocolConnect]
      at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:2282)
      at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1294)
      at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJmqiImpl.java:376)
      at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:560)
      at com.ibm.mq.MQSESSION.MQCONNX_j(MQSESSION.java:916)
      at com.ibm.mq.MQManagedConnectionJ11.&lt;init&gt;(MQManagedConnectionJ11.java:235)
      ... 12 more
  Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2397;AMQ9771: SSL handshake failed. [1=javax.net.ssl.SSLHandshakeException[Remote host closed connection during handshake],3=localhost/127.0.0.1:1414 (localhost),4=SSLSocket.startHandshake,5=default]
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1329)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnection.connect(RemoteConnection.java:863)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSessionFromNewConnection(RemoteConnectionSpecification.java:409)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSession(RemoteConnectionSpecification.java:305)
      at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(RemoteConnectionPool.java:146)
      at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:1730)
      ... 17 more
  Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:992)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1298)
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection$6.run(RemoteTCPConnection.java:1290)
      at java.security.AccessController.doPrivileged(Native Method)
      at com.ibm.mq.jmqi.remote.impl.RemoteTCPConnection.protocolConnect(RemoteTCPConnection.java:1290)
      ... 22 more
  Caused by: java.io.EOFException: SSL peer shut down incorrectly
      at sun.security.ssl.InputRecord.read(InputRecord.java:505)
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
      ... 29 more
  </code></pre>
  
  <p>Below you get the queue manager (qmanager) log file.</p>
  
  <pre><code> 2017-06-24 11:31:11 - Process(25266.5) User(root) Program(amqrmppa)
                      Host(hasitha-HP-Pavilion-g6-Notebook-PC) Installation(Installation1)
                      VRMF(8.0.0.4) QMgr(qmanager)
  
  AMQ9660: SSL key repository: password stash file absent or unusable.
  
  EXPLANATION:
  
  The SSL key repository cannot be used because MQ cannot obtain a password to access
   it. Reasons giving rise to this error include: 
  
  (a) the key database file and password stash file are not present in the
        location configured for the key repository, 
  
  (b) the key database file exists in the correct place but that no password
        stash file has been created for it, 
  
  (c) the files are present in the correct place but the userid under which MQ is
        running does not have permission to read them, 
  
  (d) one or both of the files are corrupt. 
  
  
  The channel is '????'; in some cases its name cannot be determined and so is
  shown as '????'. The channel did not start.
  ACTION:
  Ensure that the key repository variable is set to where the key database file
  is. Ensure that a password stash file has been associated with the key database
  file in the same directory, and that the userid under which MQ is running has
  read access to both files. If both are already present and readable in the
  correct place, delete and recreate them. Restart the channel.
  ----- amqccisa.c : 6283 -------------------------------------------------------
  2017-06-24 11:31:11 - Process(25266.5) User(root) Program(amqrmppa)
                      Host(hasitha-HP-Pavilion-g6-Notebook-PC) Installation(Installation1)
                      VRMF(8.0.0.4) QMgr(qmanager)
  
  AMQ9999: Channel '????' to host 'localhost (127.0.0.1)' ended abnormally.
  
  EXPLANATION:
  The channel program running under process ID 25266 for channel '????' ended
  abnormally. The host name is 'localhost (127.0.0.1)'; in some cases the host
  name cannot be determined and so is shown as '????'.
  ACTION:
  Look at previous error messages for the channel program in the error logs to
  determine the cause of the failure. Note that this message can be excluded
  completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
  attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
  found in the System Administration Guide.
  ----- amqrmrsa.c : 930 --------------------------------------------------------
  2017-06-24 11:33:54 - Process(25266.6) User(root) Program(amqrmppa)
                      Host(hasitha-HP-Pavilion-g6-Notebook-PC) Installation(Installation1)
                      VRMF(8.0.0.4) QMgr(qmanager)
  
  AMQ9660: SSL key repository: password stash file absent or unusable.
  
  EXPLANATION:
  The SSL key repository cannot be used because MQ cannot obtain a password to
  access it. Reasons giving rise to this error include: 
  (a) the key database file and password stash file are not present in the
    location configured for the key repository, 
  (b) the key database file exists in the correct place but that no password
    stash file has been created for it, 
  (c) the files are present in the correct place but the userid under which MQ is
    running does not have permission to read them, 
  (d) one or both of the files are corrupt. 
  
  The channel is '????'; in some cases its name cannot be determined and so is
  shown as '????'. The channel did not start.
  ACTION:
  Ensure that the key repository variable is set to where the key database file
  is. Ensure that a password stash file has been associated with the key database
  file in the same directory, and that the userid under which MQ is running has
  read access to both files. If both are already present and readable in the
  correct place, delete and recreate them. Restart the channel.
  ----- amqccisa.c : 6283 -------------------------------------------------------
  2017-06-24 11:33:54 - Process(25266.6) User(root) Program(amqrmppa)
                      Host(hasitha-HP-Pavilion-g6-Notebook-PC) Installation(Installation1)
                      VRMF(8.0.0.4) QMgr(qmanager)
  
  AMQ9999: Channel '????' to host 'localhost (127.0.0.1)' ended abnormally.
  
  EXPLANATION:
  The channel program running under process ID 25266 for channel '????' ended
  abnormally. The host name is 'localhost (127.0.0.1)'; in some cases the host
  name cannot be determined and so is shown as '????'.
  ACTION:
  Look at previous error messages for the channel program in the error logs to
  determine the cause of the failure. Note that this message can be excluded
  completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
  attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
  found in the System Administration Guide.
  ----- amqrmrsa.c : 930 --------------------------------------------------------
  2017-06-24 11:33:55 - Process(25266.7) User(root) Program(amqrmppa)
                      Host(hasitha-HP-Pavilion-g6-Notebook-PC) Installation(Installation1)
                      VRMF(8.0.0.4) QMgr(qmanager)
  
  AMQ9660: SSL key repository: password stash file absent or unusable.
  
  EXPLANATION:
  The SSL key repository cannot be used because MQ cannot obtain a password to
  access it. Reasons giving rise to this error include: 
  (a) the key database file and password stash file are not present in the
    location configured for the key repository, 
  (b) the key database file exists in the correct place but that no password
    stash file has been created for it, 
  (c) the files are present in the correct place but the userid under which MQ is
    running does not have permission to read them, 
  (d) one or both of the files are corrupt. 
  
  The channel is '????'; in some cases its name cannot be determined and so is
  shown as '????'. The channel did not start.
  ACTION:
  Ensure that the key repository variable is set to where the key database file
  is. Ensure that a password stash file has been associated with the key database
  file in the same directory, and that the userid under which MQ is running has
  read access to both files. If both are already present and readable in the
  correct place, delete and recreate them. Restart the channel.
  ----- amqccisa.c : 6283 -------------------------------------------------------
  2017-06-24 11:33:55 - Process(25266.7) User(root) Program(amqrmppa)
                      Host(hasitha-HP-Pavilion-g6-Notebook-PC) Installation(Installation1)
                      VRMF(8.0.0.4) QMgr(qmanager)
  
  AMQ9999: Channel '????' to host 'localhost (127.0.0.1)' ended abnormally.
  
  EXPLANATION:
  The channel program running under process ID 25266 for channel '????' ended
  abnormally. The host name is 'localhost (127.0.0.1)'; in some cases the host
  name cannot be determined and so is shown as '????'.
  ACTION:
  Look at previous error messages for the channel program in the error logs to
  determine the cause of the failure. Note that this message can be excluded
  completely or suppressed by tuning the "ExcludeMessage" or "SuppressMessage"
  attributes under the "QMErrorLog" stanza in qm.ini. Further information can be
  found in the System Administration Guide.
  ----- amqrmrsa.c : 930 --------------------------------------------------------
  </code></pre>
  
  <p>Any ideas on how to resolve this.I have the user group mqm and both root and $USER(hasitha) are users of that group.</p>