title: How to add JVM argument `-Dcom.ibm.mq.cfg.useIBMCipherMappings=false` to IBM MQ?
body: <p>Recently I've been migrated to IBM MQ v8 to IBM MQ v9 (v9.1.2.0 specifically). I used SSL to communicate with the broker. So as per <a href="https://www.ibm.com/support/knowledgecenter/SSFKSJ_9.0.0/com.ibm.mq.sec.doc/q014265_.htm" rel="nofollow noreferrer">Deprecated CipherSpecs</a> document, IBM has deprecated number of cipher suites that came up with MQ 8 and seems all of the cipher suites I've been using, have been deprecated with v9 upward. Therefore, I've implemented new TLS cipher suites to work with my application which runs on a Oracle JVM (version 1.8.0_211). Ever since I'm getting following exception in the application though;</p>
  
  <pre><code>com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2400'.
      at com.ibm.mq.MQManagedConnectionJ11.constructMQCD(MQManagedConnectionJ11.java:1437)
      at com.ibm.mq.MQManagedConnectionJ11.constructCNO(MQManagedConnectionJ11.java:1537)
      at com.ibm.mq.MQManagedConnectionJ11.&lt;init&gt;(MQManagedConnectionJ11.java:221)
      ... (Omitted the rest)
  </code></pre>
  
  <p>When I dig about the reason, found that's a problem with IBM MQ cipher suites and Oracle JRE cipher suite name mismatch. But I did refer <a href="https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.mq.dev.doc/q113220_.htm" rel="nofollow noreferrer">TLS CipherSpecs and CipherSuites in IBM MQ classes for JMS</a> document to map cipher suite names. I used some of <strong>Equivalent CipherSuite (Oracle JRE)</strong> column values in my application that already available in IBM MQ as well. But still getting the issue.</p>
  
  <p>After I found <a href="https://developer.ibm.com/answers/questions/493951/unable-to-connect-to-queue-manager-mqv90-from-jms/?smartspace=powerai" rel="nofollow noreferrer">this answer</a> that advises to add this <code>-Dcom.ibm.mq.cfg.useIBMCipherMappings=false</code> argument to IBM MQ's JRE (As I understand). This might allow IBM MQ to use Oracle complied cipher suite names. My question is,</p>
  
  <ol>
  <li>How to add this JVM argument <code>-Dcom.ibm.mq.cfg.useIBMCipherMappings=false</code> to IBM MQ JRE?</li>
  </ol>
  
  <p>This <a href="https://stackoverflow.com/questions/52775733/problem-connecting-a-java-client-jms-to-a-ibm-mq">Problem Connecting a Java Client (JMS) to a IBM MQ</a> question suggests that the same parameter needed to be added to the application as a system property <code>System.setProperty("com.ibm.mq.cfg.useIBMCipherMappings", "false")</code>, but it didn't make any different. </p>
  
  <p><a href="https://stackoverflow.com/questions/43194227/java-connection-to-wmq-8">Java connection to WMQ 8</a> question also states the same solution, but doesn't mention how to add this JVM argument to IBM MQ.</p>
  
  <p><strong>Update 1</strong></p>
  
  <p>I did some research about how to add a JVM argument to IBM MQ. But I was only able to find a solutions for Websphere application server.</p>
  
  <p>CipherSuite I'm currently using in the application is; </p>
  
  <blockquote>
    <p><strong>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</strong> (Oracle JRE complied)</p>
  </blockquote>
  
  <p>IBM MQ has respective;</p>
  
  <blockquote>
    <p><strong>ECDHE_ECDSA_AES_128_CBC_SHA256</strong> (IBM MQ complied)</p>
  </blockquote>
  
  <p><strong>Update 2</strong></p>
  
  <p>After creating a <code>key.kdb</code> file with <code>ikeyman</code> tool with the <code>stash</code> option queue manager can successfully read the certificates in it. Also, I've included a self-signed certificate labeled with <code>ibmwebspheremq&lt;lowercase_queue_manage_name&gt;</code>. But now I'm getting a different exception in the client side;</p>
  
  <pre><code>Exception in thread "main" com.ibm.mq.MQException: MQJE001: Completion Code '2', Reason '2059'.
      at com.ibm.mq.MQManagedConnectionJ11.&lt;init&gt;(MQManagedConnectionJ11.java:255)
      at com.ibm.mq.MQClientManagedConnectionFactoryJ11._createManagedConnection(MQClientManagedConnectionFactoryJ11.java:450)
      at com.ibm.mq.MQClientManagedConnectionFactoryJ11.createManagedConnection(MQClientManagedConnectionFactoryJ11.java:487)
      at com.ibm.mq.StoredManagedConnection.&lt;init&gt;(StoredManagedConnection.java:97)
  </code></pre>
  
  <p>and in the MQ log I can find this entry;</p>
  
  <pre><code>AMQ9637E: Channel is lacking a certificate.
  </code></pre>
  
  <p>with some explanation. </p>