Unable to establish connection over TLS 1.2 on AIX 7.1/7.2


 
Thread Tools Search this Thread
Operating Systems AIX Unable to establish connection over TLS 1.2 on AIX 7.1/7.2
# 1  
Old 02-18-2019
Unable to establish connection over TLS 1.2 on AIX 7.1/7.2

Hello Team,

I would need your help to enable communication over TLS1.2 on AIX 7.1 or 7.2 with IBM JDK 1.8 latest update.

By default, the request is trying to establish a connection over TLSv1 even though TLS 1.2 is explicitly enabled on server as well as on Java 8. The openssl command throws SSL handshake error. We tried with 2 versions of OpenSSL, 1.0.1e and 1.0.2k, but same behavior. Please find the logs below:
Code:
[06:24 AM root@s822-aix01p1 /opt]: openssl s_client -tls1_2 -connect 10.225.120.125:8443
CONNECTED(00000003)
804401144:error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error:s3_pkt.c:1259:SSL alert number 80
804401144:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:599:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1550489753
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

It seems there is no cipher suites on common which can work for TLS 1.2. Kindly let me know if you need more information to root cause this issue.

Also, is there any way to enable TLS 1.1 & 1.2 in AIX as I have read few articles and got to know that these are not enabled by default on AIX.

Thanks,
Naina

Moderator's Comments:
Mod Comment MOD's comment: Kindly wrap your sample of input and expected output into CODE TAGS [CODE]your code....[/CODE] buttons as per forum's rule.

Last edited by RavinderSingh13; 02-19-2019 at 06:52 AM..
# 2  
Old 02-18-2019
Hi,

I'm going to suggest this is the issue that you have, there is an IBM thread here which may be worth having a look at.

Regards

Gull04
# 3  
Old 02-18-2019
Thread moved to AIX...
This User Gave Thanks to vbe For This Post:
# 4  
Old 02-19-2019
Thanks Gull04. I have tried the debug options provided in the link and got to know that there are no ciphers in common to establish a connection.
Also I could see only SSL_* ciphers are enabled. Can you please help me to enable TLS_* ciphers in IBM JDK8, so that it can communicate over TLS 1.2.

Here are the logs :

Code:
Using SSLEngineImpl.
Is initial handshake: true
qtp-1722886128-39, READ: TLSv1 Handshake, length = 182
*** ClientHello, TLSv1.2
RandomCookie:  GMT: -1246685516 bytes = { 14, 70, 82, 17, 142, 160, 104, 40, 220, 61, 116, 139, 67, 63, 91, 48, 1, 149, 197, 162, 246, 61, 155, 115, 103, 215, 79, 30 }
Session ID:  {}
Cipher Suites: [Unknown 0xcc:0xa9, Unknown 0xcc:0xa8, Unknown 0xcc:0x14, Unknown 0xcc:0x13, SSL_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSL_DHE_RSA_WITH_AES_128_GCM_SHA256, SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_AES_128_GCM_SHA256, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA]
Compression Methods:  { 0 }
Extension renegotiation_info, ri_length: 0, ri_connection_data: { null }
Extension extended_master_secret
Unsupported extension type_35, data:
Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
Unsupported extension status_request, data: 01:00:00:00:00
Unsupported extension type_13172, data:
Unsupported extension type_18, data:
Extension application_layer_protocol_negotiation, protocol names: [h2][spdy/3.1][http/1.1]
Unsupported extension type_30032, data:
Extension ec_point_formats, formats: [uncompressed]
Extension elliptic_curves, curve names: {secp256r1, secp384r1}
***
ALPNJSSEExt not initialized for Server
ALPN will not be negotiatedc51426f1[SSLEngine[hostname=10.74.7.16 port=57233] SSL_NULL_WITH_NULL_NULL]
%% Initialized:  [Session-3, SSL_NULL_WITH_NULL_NULL]
qtp-1722886128-39, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated:  [Session-3, SSL_NULL_WITH_NULL_NULL]
qtp-1722886128-39, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
qtp-1722886128-39, WRITE: TLSv1.2 Alert, length = 2
qtp-1722886128-39, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
qtp-1722886128-39, called closeOutbound()
qtp-1722886128-39, closeOutboundInternal()

Regards,
Naina
# 5  
Old 02-22-2019
I did more R&D and found that it is IBM Java which is not allowing communication over TLS 1.2. The same handshake failure was observed on Linux with IBM Java, though it was successful with Oracle Java.

Does anybody has any idea how to enable TLS 1.2 on IBM Java 8?

Regards!
Naina
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. BSD

Can't establish outbound ssh connection on an OpenBSD system

I am getting the below error when I try to make outbound ssh from an OpenBSD system. I can't ssh to any host except the localhost. I can ping the hosts which I can't ssh, though.~ uname -rs OpenBSD 6.1 ~ ssh -V OpenSSH_7.5, LibreSSL 2.5.2 ~ ssh hostname ssh: connect to host hostname... (11 Replies)
Discussion started by: milhan
11 Replies

2. Red Hat

Proxy tunneling failed: ForbiddenUnable to establish SSL connection.

Tryied both ways curl and wget wget --no-check-certificate https://mysitet.it:61617 --2017-05-05 17:29:02-- https://mysitet.it:61617/ Connecting to myproxy:8080... connected. Proxy tunneling failed: ForbiddenUnable to establish SSL connection. curl https://mysite.it:61617 curl: (56)... (3 Replies)
Discussion started by: charli1
3 Replies

3. Red Hat

Connection establish two server

How do make connection between two linux server.Such as SSH,rsync,ftp (3 Replies)
Discussion started by: Mani T
3 Replies

4. Solaris

How to configure CUPS on Solaris 11.3 - TLS and no TLS?

We are implementing CUPS on a new Solaris 11.3 system. The same system will run an application where users can print to networked printers inside our organisation, or to a printer outside of our organisation over the internet. For users printing to internal network printers, no encryption is... (0 Replies)
Discussion started by: SallyB
0 Replies

5. AIX

AIX LDAP client authenticate against Linux Openldap server over TLS/SSL

Hi folks, How can i configure an AIX LDAP client to authenticate against an Linux Openldap server over TLS/SSL? It works like a charm without TLS/SSL. i would like to have SSL encrypted communication for ldap (secldapclntd) and ldapsearch etc. while accepting every kind of certificate/CA.... (6 Replies)
Discussion started by: paco699
6 Replies

6. AIX

AIX sendmail and tls

The situation Version AIX7.1/8.14.4 Compiled with: DNSMAP LDAPMAP LDAP_REFERRALS LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7 NAMED_BIND NDBM NETINET NETINET6 NETUNIX NEWDB NIS NISPLUS PIPELINING SCANF STARTTLS USERDB USE_LDAP_INIT XDEBUG... (2 Replies)
Discussion started by: Linusolaradm1
2 Replies

7. IP Networking

Unable to connect to internet on slackware 14.1 (hathway connection)

Hi, I have a wired internet connection of hathway provider. I would like to use the connection on my desktop as well as my laptop. My desktop pc has windows 7 and yesterday I installed slackware 14.1 (full installation) on my lenovo 3000 n100 laptop. Previously I had slacko puppy 5.7... (7 Replies)
Discussion started by: pinakbheed
7 Replies

8. Shell Programming and Scripting

Establish ODBC connection from Linux

Hi All, I want to establish a ODBC connection to a database from linux and query the tables of a database. Please let me know how I can achieve this. Thanks and Regards Nagaraja Akkivalli. (0 Replies)
Discussion started by: Nagaraja Akkiva
0 Replies

9. HP-UX

Xterm :Cannot establish a connection to "Server IP" on port 22

Dears, I installed HP-UX Server, when I tried to reach it through Xterm it returns the error like Xrcmd Cannot establish a connection to "Server IP" on port 22 Anyone here to tell me the reason(s) find attached xterm.jpg (3 Replies)
Discussion started by: smartyshan
3 Replies
Login or Register to Ask a Question