Error: "java.lang.ArrayIndexOutOfBoundsException". ClientConnectionId:7ff96a80-64fc-42fa-b1e6-e45661efe819DSRA0010E: SQL State = 08S01, Error Code = 0.


The problem happens because the handshaking with TLSv1 when 2048 DH key was used. However, in IBMJSSE2, 2048 DH key was only allowed when handshake is performed with TLSv1.2. When you use TLSv1.2, you will not see this problem anymore. So, Please try to use Switch to SSL_TLSv2 where it can use TLSv1.2 for case.. In order to handle 2048 DH public keys, we need to handshake with TLSv1.2 protocol. For that, they can create the SSL Context with SSL_TLSv2 to send the TLSv1.2 in the ClientHello
Following Workaround solutions:
--> 1. switch to TLSv1.2 with 2048 DH keys
--> 2. switch to 1024 DH keys with TLSv1
--> 3. Switch to SSL_TLSv2
--->4. Disable cipher suites which uses DH/DHE key exchange
APAR IV73472 where it has description LARGE PRE-MASTER SECRET GENERATED FROM 2048 BIT DH KEY NOT DIGESTED IN TLSV1 AND TLSV1.1 The problem happens when the server side uses large DH key (e.g. 2048 bit) in TLSv1/TLSv1.1 key exchange.
IBM IV73472: LARGE PRE-MASTER SECRET GENERATED FROM 2048 BIT DH KEY NOT DIGESTED IN TLSV1 AND TLSV1.1 - United States
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IV73472
So please use TLSv1.2 or SSL_TLSv2 to fix the issue..
a.Log on to https://:9043/ibm/console as consoleuser.
b.Go to Security > SSL certificate and key management > Manage endpoint security configurations c.Select Node01 from the Inbound folder and click on SSL configurations ( NodeDefaultSSLsetting and CellDefaultSSLsetting) Note: For each node it has their own NodeDefaultSSLsetting
d.Select each SSL Configuration described above, then click Quality of protection (QoP) settings under Additional Properties.
e.On the Quality of protection (QoP) settings panel, select TLSv1.2 from the pull-down list in the box named Protocol. change the protocol to TLSV1.2
f.Click Apply and Save.
6.Update ssl.client.props:
The SSL protocol is set with the com.ibm.ssl.protocol property in the ssl.client.props file. Edit the ssl.client.props file and set the com.ibm.ssl.protocol value to TLS.

Comments

Popular Posts