title: Failed to Connect with Websphere MQ SSL Channel through JNDI
body: <p>My JMS client connects to WMQ through JNDI. The initial context factory used is <code>com.ibm.mq.jms.context.WMQInitialContextFactory</code>.</p>
  
  <p>Currently, at WMQ side, there's a queue manager called <code>TestMgr</code>. Under this queue manager I created two channels. One is <code>PLAIN.CHL</code> which does not specify an SSL Cipher Spec, the other one is <code>SSL.CHL</code> which configured SSL Cipher Spec with <code>RC4_MD5_US</code> and SSL Authentication with <code>Optional</code>. </p>
  
  <p>I have created a key store for the queue manager using IBM Key Management tool. The path of key db is <code>[wmq_home]\qmgrs\TestMgr\ssl\key</code>.</p>
  
  <p>For channel <code>PLAIN.CHL</code>, I defined a queue connection factory like:</p>
  
  <pre><code>DEF QCF(PlainQCF) QMANAGER(TestMgr) CHANNEL(PLAIN.CHL) HOST(192.168.66.23) PORT(1414)   TRANSPORT(client)
  </code></pre>
  
  <p>And under the SSL channel <code>SSL.CHL</code>, I defined a queue connection factory like:</p>
  
  <pre><code>DEF QCF(SSLQCF) QMANAGER(TestMgr) CHANNEL(SSL.CHL) HOST(192.168.66.23) PORT(1414) TRANSPORT(client) SSLCIPHERSUITE(SSL_RSA_WITH_RC4_128_MD5)
  </code></pre>
  
  <p>Now I only can create connection using the <code>PlainQCF</code>. But failed to look up the SSL queue connection factory. My code looks like:</p>
  
  <pre><code> Hashtable environment = new Hashtable();
      environment.put(Context.INITIAL_CONTEXT_FACTORY, "com.ibm.mq.jms.context.WMQInitialContextFactory");
      environment.put(Context.PROVIDER_URL, "192.168.66.23:1414/SSL.CHL");
      Context ctx = new InitialContext( environment );
      QueueConnectionFactory qcf = (QueueConnectionFactory) ctx.lookup("SSLQCF");
      qcf.createConnection();
      ....
  </code></pre>
  
  <p>Am I missing some context properties when looking up the SSL factory? connection And then I found the code is hanging on the line <code>new InitialContext( environment )</code> for a long time, almost 5 minutes, and I got <code>CC=2;RC=2009;AMQ9208...</code> error. </p>
  
  <p>Any suggestion would be appreciated. Is it true that SSL channel can't be connected by JNDI?</p>
  
  <hr>
  
  <p>@T.Rob, thanks for your reply very much. But we still want to use <code>WMQInitialContextFactory</code>, so I'm afraid I still need to find solution for this.</p>
  
  <p>I just defined the connection factory one time. The displayed info for the SSL queue connection factory like:</p>
  
  <pre><code>InitCtx&gt; DISPLAY QCF(SSLQCF)
  ASYNCEXCEPTION(ALL)
  CCSID(819)
  CHANNEL(SSL.CHL)
  CLIENTRECONNECTOPTIONS(ASDEF)
  CLIENTRECONNECTTIMEOUT(1800)
  COMPHDR(NONE )
  COMPMSG(NONE )
  CONNECTIONNAMELIST(192.168.66.23(1414))
  CONNOPT(STANDARD)
  FAILIFQUIESCE(YES)
  HOSTNAME(192.168.66.23)
  LOCALADDRESS()
  MAPNAMESTYLE(STANDARD)
  MSGBATCHSZ(10)
  MSGRETENTION(YES)
  POLLINGINT(5000)
  PORT(1414)
  PROVIDERVERSION(UNSPECIFIED)
  QMANAGER(TestMgr)
  RESCANINT(5000)
  SENDCHECKCOUNT(0)
  SHARECONVALLOWED(YES)
  SSLCIPHERSUITE(SSL_RSA_WITH_RC4_128_MD5)
  SSLFIPSREQUIRED(NO)
  SSLRESETCOUNT(0)
  SYNCPOINTALLGETS(NO)
  TARGCLIENTMATCHING(YES)
  TEMPMODEL(SYSTEM.DEFAULT.MODEL.QUEUE)
  TEMPQPREFIX()
  TRANSPORT(CLIENT)
  USECONNPOOLING(YES)
  VERSION(7)
  WILDCARDFORMAT(TOPIC_ONLY)
  </code></pre>
  
  <p>The JNDI Provider should be fine because I can look up the plain connection factory successfully. Also, for my client app, I extracted the cert from the key store which created for MQ server and imported it to the trust store(cacerts) of my JRE with alias name <code>ibmwebspheremqtestmgr</code>.</p>
  
  <p>You are correct, with 2009 error there are some log entries:</p>
  
  <pre><code>=================================================================
  
  4/20/2012 20:24:27 - Process(13768.3) User(MUSR_MQADMIN) Program(amqzmur0.exe)
                        Host(xxxx_host of my MQ) Installation(mqenv)
                        VRMF(7.1.0.0) QMgr(TestMgr)                
  AMQ6287: WebSphere MQ V7.1.0.0 (p000-L111019).
  EXPLANATION:
  WebSphere MQ system information: 
  Host Info         :- Windows Server 2003, Build 3790: SP2 (MQ Windows 32-bit) 
  Installation      :- C:\IBM\WebSphereMQ (mqenv) 
  Version           :- 7.1.0.0 (p000-L111019)
  ACTION:
  None. 
  
  -------------------------------------------------------------------------------
  4/20/2012 20:24:27 - Process(7348.116) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                        Host(xxxx_host of my MQ) Installation(mqenv)
                        VRMF(7.1.0.0) QMgr(TestMgr)
  AMQ9639: Remote channel 'SSL.CHL' did not specify a CipherSpec.
  
  EXPLANATION:
  Remote channel 'SSL.CHL' did not specify a CipherSpec when the local channel
  expected one to be specified. 
  
  The remote host is 'xxx_host of my app (192.168.66.25)'. 
  The channel did not start.
  
  ACTION:
  Change the remote channel 'SSL.CHL' on host 'xxx_host of my app (192.168.66.25)' to
  specify a CipherSpec so that both ends of the channel have matching
  CipherSpecs.
  
  ----- amqcccxa.c : 3817 -------------------------------------------------------
  4/20/2012 20:24:27 - Process(7348.116) User(MUSR_MQADMIN) Program(amqrmppa.exe)
                        Host(my app host) Installation(mqenv)
                      VRMF(7.1.0.0) QMgr(TestMgr)                    
  AMQ9999: Channel 'SSL.CHL' to host 'xxx_host of my app (192.168.66.25)' ended
  abnormally.
  
  ====================================================================
  </code></pre>
  
  <p>I also got some confusion with the error log. My app staged at at a machine which is different from my MQ. But the log says the <code>Change the remote channel 'SSL.CHL' on host 'xxx_host of my app (192.168.66.25)' to
  specify a CipherSpec so that both ends of the channel have matching
  CipherSpecs.</code> How can I change the channel cipher spec on my app host?</p>
  
  <hr>
  
  <h3>updates on MQEnvironment...</h3>
  
  <p>reply the comments.</p>
  
  <p>The value of <code>MQEnvironment.sslCipherSuite</code> is null, so it throws out NullPointerExcetpion when i put it the the env hashtable. But i tried another one <code>environment.put(MQC.SSL_CIPHER_SUITE_PROPERTY, "SSL_RSA_WITH_RC4_128_MD5")</code> and it still failed with <code>2009</code> error. </p>
  
  <p>For <code>JMSAdmin</code> tool, i had changed the config to use <code>WMQInitialContextFactory</code>. The configuration like(<code>JMSAdmin.config</code>):</p>
  
  <pre><code>INITIAL_CONTEXT_FACTORY=com.ibm.mq.jms.context.WMQInitialContextFactory
  PROVIDER_URL=192.168.66.23:1414/SYSTEM.DEF.SVRCONN
  </code></pre>
  
  <p>The rest configuration leaves as default.</p>
  
  <p>Kindly note, here i use the default channel <code>SYSTEM.DEF.SVRCONN</code> so that i can logon to admin console. If I change the channel to the SSL one<code>SSL.CHL</code>, I also can't logon to admin console. The error happened here is just like the one in my client app. </p>
  
  <p>Another clarification, in my client, i use follow code can connect to connect qmgr(<code>TestMgr</code>) successfully through channel <code>SSL.CHL</code>.</p>
  
  <pre><code>   MQConnectionFactory factory = new MQConnectionFactory();
      factory.setTransportType(JMSC.MQJMS_TP_CLIENT_MQ_TCPIP);
      factory.setQueueManager("TestMgr");
      factory.setSSLCipherSuite("SSL_RSA_WITH_RC4_128_MD5");
      factory.setPort(1414);
      factory.setHostName("192.168.66.23");
      factory.setChannel("SSL.CHL");
  
      MQConnection connection = (MQConnection) factory.createConnection();
  </code></pre>
  
  <p>And now the problem is just like you said, that's the initial context failed connect to qmgr through SSL channel. The option(<code>use plain channel for initial context and ssl channel for connection factory</code>) you provided works too. But I still want to know how to get initial context with ssl channel work. Thanks for you patience very much. Your updates will be appreciated.</p>
  
  <p>thanks </p>