Question
JP Morgan Chase
IN
Last activity: 26 Dec 2016 6:30 EST
SSL Issues
We are migrating our 5.5(Websphere 7 and Java 6) Application to 6.3 SP1(Websphere 8.5.5 and Java 7).
We are observing SSL Peer Verified exception whenever trying to search a Rule as that involves calling a Connect-HTTP. Dont see any issues at a high level in the inbound and outbound configurations of Security in Websphere console.
Apart from this , whenever we do a Test Connectivity on Email Account, we get a Cipher Exception there as well as follows:
Caused by:
javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
The 2 Way SSL configured Webservices are also not working. Is there a compatibility issue in WAS 8 (Java 7) and 6.3? If yes, how can we circumvent it.
Pegasystems Inc.
US
Would have to get a closer look - this may need an SR. Either way, you'll need to get the SSL log by setting -Djavax.net.debug=all on the jvm.
SSL security gets stricter as you move up the JDK ... so a quick test is to configure WebSphere 8 to use Java 6.
Also, see this PDN article for possible correlation - https://community.pega.com/support/support-articles/peer-not-authenticated-sslv3-issue
Pegasystems Inc.
GB
I Agree with PaulGentile's post here: this isn't strictly-speaking a PRPC issue - it is a matter of JDK security.
From the error:
javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
It looks like perhaps the endpoint is using an older protocols/cipher suites which the newer JDK doesn't like ? (And doesn't like for good reasons).
The PDN article already provided looks to be the best bet here.
Pegasystems Inc.
IN
Hello!
Please let us know if you do log an SR for this and its ID. That way we can track it and follow-up this discussion with the resolution.
Regards,
Lochan | Community Moderator | Pegasystems Inc.
JP Morgan Chase
IN
We are using TLS V1.2 as QOP setting in Websphere and not SSL V3. It is coming even if we try to search a Rule. As of now,have changed the SearchSOAPURI DSS to use a non-SSL url and it is working. But need a solution for this. The PDN article doesnt help much with this regard.