PH11527: CSQX635E INVALID CIPHER SPECIFICATION C02F / C030 FOR CHANNEL 20/08/18 PTF PECHANGE

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Change Team finds an interaction between (PI95952 & PI97499)
  which may affect the ability to use certain ciphers, with an
  external symptom of CSQX635E when an SSL/TLS channel using :
  .
  ECDHE_RSA_AES_256_GCM_SHA384  X'C030'
  ECDHE_RSA_AES_128_GCM_SHA256  X'C02F'
  .
  is started.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of IBM MQ for z/OS Version 8       *
  *                 Release 0 Modification 0.                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: When applying PI97499/UI56544 in        *
  *                      combination with PI95952/UI56025 and    *
  *                      PI97549/UI56135, the use of the C02F    *
  *                      and C030 CipherSpecs may not be         *
  *                      possible in some cases. An attempt to   *
  *                      use these CipherSpecs for a channel     *
  *                      will result in a CSQX635E message in    *
  *                      both the sender and receiver CHIN log.  *
  ****************************************************************
  PI97499, PI95952 and PI97549 made overlapping changes in the
  same areas of SSL code. Incompatibilities between these APARs
  occurred due to changes in include files not being propagated
  forward to the resulting PTFs. This resulted in some of the
  changed areas of code using out-of-date include files, which
  caused the use of the C02F and C030 CipherSpecs to not work
  correctly in some cases.
  

Problem conclusion

• The latest versions of the at-fault include files were included
  in the SSL code. This allows the use of the C02F and C030
  CipherSpecs as originally intended by PI97499.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI71108

Modules/Macros

• CSQDSMFC CSQMCNAC CSQXCCIS CSQXGINI CSQXJST  CSQXRCML CSQXSMFU
  CSQXSSLI
  

Fix information

• Fixed component name

  IBM MQ Z/OS V8

• Fixed component ID

  5655W9700

Applicable component levels

• R000 PSY UI71108

     UP20/10/13 P F010 {

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.