title: WMQ JMS API SSL Sun JDK and SSL_RSA_WITH_AES_128_CBC_SHA
body: <p>How do I get a JMS Client using SSL_RSA_WITH_AES_128_CBC_SHA (in the queue connection factory) to connect to a server using  TLS_RSA_WITH_AES_128_CBC_SHA</p>
  
  <ul>
  <li>Client Sun JDK 7 win</li>
  <li>Server IBM Power (i) </li>
  <li>MQ version 7.1 on the server</li>
  <li>MQ version 7.5.0.4 on the client </li>
  <li>Connections with MQ Explorer works fine </li>
  <li>the below code works with the ibm JDK C:\Program Files\IBM\WebSphere MQ Explorer\jre\jre\bin</li>
  <li>the below code does not work with "C:\Program Files\Java\jdk1.7.0_67\bin with <a href="http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html" rel="nofollow">Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 7 Download installed</a> </li>
  </ul>
  
  <p>Code: </p>
  
  <pre><code>       // Instantiate the initial context
          String contextFactory = "com.sun.jndi.fscontext.RefFSContextFactory";
          Hashtable environment = new Hashtable();
          environment.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);
          environment.put(Context.PROVIDER_URL, initialContextUrl);
          Context context = new InitialDirContext(environment);
          System.out.println("Initial context found!");
  
          String keystoreName = System.getProperty("javax.net.ssl.keyStore");
          System.out.println("keystoreName " + keystoreName + " canRead " + new File(keystoreName).canRead());
          String truststoreName = System.getProperty("javax.net.ssl.trustStore");
          System.out.println("truststoreName " + keystoreName + " canRead " + new File(truststoreName).canRead());
  
  
          // Lookup the connection factory
          JmsConnectionFactory cf = (JmsConnectionFactory) context.lookup(connectionFactoryFromJndi);
  
  
          System.out.println("CF = " + cf.getClass().getName());
  
          MQConnectionFactory mqcf = (MQConnectionFactory) cf;
          System.out.println("getSSLCipherSuite:" + mqcf.getSSLCipherSuite());
          System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());
  
          // Lookup the destination
          destination = (JmsDestination) context.lookup(destinationFromJndi);
          System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());
  
          // Create JMS objects
          connection = cf.createConnection();
          System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());
  
          session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
          System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());
  
          consumer = session.createConsumer(destination);
          System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());
  
          // Start the connection
  
          connection.start();
          System.out.println("getSSLSocketFactory:" + mqcf.getSSLSocketFactory());
  </code></pre>
  
  <p>Gives me: </p>
  
  <pre><code> Initial context found!
  keystoreName C:/Users/...key.jks canRead true
  truststoreName C:/Users/.../key.jks canRead true
  CF = com.ibm.mq.jms.MQConnectionFactory
  getSSLCipherSuite:SSL_RSA_WITH_AES_128_CBC_SHA
  getSSLSocketFactory:null
  getSSLSocketFactory:null
  keyStore is : C:/Users/.../key.jks
  keyStore type is : jks
  keyStore provider is : 
  init keystore
  init keymanager of type SunX509
  ***
  found key for : ibmwebspheremquserid
  .....
    Valid from Mon May 14 23:59:46 CEST 2012 until Thu May 14 23:59:46 CEST 2015
  
  trigger seeding of SecureRandom
  done seeding SecureRandom
  Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
  Allow unsafe renegotiation: false
  Allow legacy hello messages: true
  Is initial handshake: true
  Is secure renegotiation: false
  com.ibm.msg.client.jms.DetailedJMSException: JMSWMQ0018: Failed to connect to queue manager 'qm' with connection mode 'Client' and host name 'host(1414)'.
  Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information.
  Inner exception(s):
  com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2393' ('MQRC_SSL_INITIALIZATION_ERROR').
  com.ibm.mq.jmqi.JmqiException: CC=2;RC=2393;AMQ9204: Connection to host 'host(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Unsupported ciphersuite SSL_RSA_WITH_AES_128_CBC_SHA],3=host/host:1414 (10.20.28.12),4=SSLSocket.createSocket,5=default]],3=host(1414),5=RemoteTCPConnection.makeSocketSecure]
  com.ibm.mq.jmqi.JmqiException: CC=2;RC=2393;AMQ9771: SSL handshake failed. [1=java.lang.IllegalArgumentException[Unsupported ciphersuite SSL_RSA_WITH_AES_128_CBC_SHA],3=host/host:1414 (10.20.28.12),4=SSLSocket.createSocket,5=default]
  java.lang.IllegalArgumentException: Unsupported ciphersuite SSL_RSA_WITH_AES_128_CBC_SHA
  FAILURE
  </code></pre>