RAD/WAS SSL handshake errors when TLSv1.2 enabled
![]()
I have RAD 9.5.0.1 with RTC 5.0.2 iFix008 connected to a local WAS 8.5.5.8 instance. When trying to start the WAS server within RAD, I get SSL errors. I have configured the WAS and RAD/RTC environments with the proper TLSv1.2 changes:
WAS - QOP settings in WAS admin console - Added com.ibm.ssl.protocol=TLSv1.2 to ssl.client.properties in the WAS profile - Cleared temp files RTC/RAD - Added entries to eclipse.ini -Dcom.ibm.team.repository.transport.client.protocol=TLSv1.2 -Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 - Added com.ibm.ssl.protocol=TLSv1.2 to ssl.client.properties in C:\Program Files\IBM\SDP\runtimes\base_stub\properties. The WAS server actually does start when selecting Start through RAD/RTC, but the status never changes to started. I have to stop the server by running the usual stopserver command. It seems that something in the RTC/RAD environment is still trying to connect to WAS using TLSv1. I have verified that WAS is using TLSv1.2 when connecting with browsers. Before the TLSv1.2 changes are made, RTC/RAD can stop/start the WAS server just fine. Currently, we have to be at RTC 5.0.2 since that what our servers are at and I'm not sure the infrastructure team will be upgrading any time soon. I've been through most of the debug steps listed at http://www-01.ibm.com/support/docview.wss?uid=swg21266028. Currently checking on key length now, but I would have expected a different error if the key length was a problem. Errors from WAS log: [1/13/16 14:47:17:943 EST] 00000086 SSLHandshakeE E SSLC0008E: Unable to initialize SSL connection. Unauthorized access was denied or security settings have expired. Exception is javax.net.ssl.SSLHandshakeException: Client requested protocol TLSv1 not enabled or not supported at com.ibm.jsse2.lb.B(lb.java:529) at com.ibm.jsse2.SSLEngineImpl.b(SSLEngineImpl.java:91) at com.ibm.jsse2.SSLEngineImpl.c(SSLEngineImpl.java:310) at com.ibm.jsse2.SSLEngineImpl.wrap(SSLEngineImpl.java:505) at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:16) at com.ibm.ws.ssl.channel.impl.SSLUtils.handleHandshake(SSLUtils.java:747) at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.readyInbound(SSLConnectionLink.java:566) at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.ready(SSLConnectionLink.java:295) at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.sendToDiscriminators(NewConnectionInitialReadCallback.java:214) at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.complete(NewConnectionInitialReadCallback.java:113) at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175) at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217) at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161) at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138) at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204) at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775) at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905) at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1881) Caused by: javax.net.ssl.SSLHandshakeException: Client requested protocol TLSv1 not enabled or not supported at com.ibm.jsse2.p.a(p.java:36) at com.ibm.jsse2.SSLEngineImpl.a(SSLEngineImpl.java:72) at com.ibm.jsse2.lb.a(lb.java:44) at com.ibm.jsse2.lb.a(lb.java:460) at com.ibm.jsse2.nb.a(nb.java:455) at com.ibm.jsse2.nb.a(nb.java:618) at com.ibm.jsse2.lb.t(lb.java:241) at com.ibm.jsse2.lb$1.run(lb$1.java:1) at java.security.AccessController.doPrivileged(AccessController.java:452) at com.ibm.jsse2.lb$c_.run(lb$c_.java:8) at com.ibm.ws.ssl.channel.impl.SSLUtils.handleHandshake(SSLUtils.java:834) Any ideas?? Thanks, Mike |
2 answers
![]()
I was able to make one of our existing RAD 8.5 environments connect to the WAS 8.5.5 instance, so it looks like there's something specific with RAD 9.5 that is different. I know there is a soap.client.properties file. Maybe that needs some changes as well? I can't find any documentation stating that though.
In some of the reading I have been doing about the errors I am seeing, I have come across threads mentioning java SSL connection API calls being made with default connection settings may use TLSv1. This would explain what is happening. If there's some environment variable not being set in RAD, when it tries to connect to WAS, it's using default settings, which do not use TLSv1.2. |
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.