title: 2538 error on MQ for SSL channel connection
body: <p>I am using IBM WebSphere MQ 8.0 version.</p>
  
  <p>I have configured one of my channels with "TLS_RSA_WITH_AES_256_CBC_SHA256" Cipher Spec encryption along with valid certificates installed and mapped to key store path correctly.</p>
  
  <p>My .NET client code is not able to connect with this secured channel. It gives 2538 error continuously.
  I have another channel configured without encryption (unsecured). The client code can connect to this channel without any errors.</p>
  
  <p>This is my .NET client code:</p>
  
  <pre><code>        Hashtable queueProperties = new Hashtable();
          queueProperties[MQC.HOST_NAME_PROPERTY] = host; // IP address
          queueProperties[MQC.PORT_PROPERTY] = 1541
          queueProperties[MQC.CHANNEL_PROPERTY] = channel; // channel name
          queueProperties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_MANAGED;
          queueProperties[MQC.SSL_CERT_STORE_PROPERTY] = "*USER";
          queueProperties[MQC.SSL_CIPHER_SPEC_PROPERTY] = "TLS_RSA_WITH_AES_256_CBC_SHA256";
          queueProperties[MQC.SSL_PEER_NAME_PROPERTY] = "CN=FXCMTST1,O=IBM,C=US";
          queueProperties["CertificateLabel"] = "ibmwebspheremqfxcmtst1";
          queueProperties[MQC.KEY_RESET_COUNT] = 0;
          MQEnvironment.SSLCertRevocationCheck = true;
          queueProperties[MQC.USER_ID_PROPERTY] = user; // variable
          queueProperties[MQC.PASSWORD_PROPERTY] = pwd; // variable
          try
          {
              // Attempt the connection
              queueManager = new MQQueueManager(qmgr, queueProperties);
              strReturn = "Connected Successfully";
          }
  </code></pre>
  
  <p>I have also set the MCA User to the valid user with all required access rights.</p>
  
  <p>The above code works fine for the unsecured channel when I remove these lines and replace the channel name with that of unsecured one.</p>
  
  <pre><code>    queueProperties[MQC.TRANSPORT_PROPERTY] = MQC.TRANSPORT_MQSERIES_MANAGED;
      queueProperties[MQC.SSL_CERT_STORE_PROPERTY] = "*USER";
      queueProperties[MQC.SSL_CIPHER_SPEC_PROPERTY] = "TLS_RSA_WITH_AES_256_CBC_SHA256";
      queueProperties[MQC.SSL_PEER_NAME_PROPERTY] = "CN=FXCMTST1,O=IBM,C=US";
      queueProperties["CertificateLabel"] = "ibmwebspheremqfxcmtst1";
      queueProperties[MQC.KEY_RESET_COUNT] = 0;
      MQEnvironment.SSLCertRevocationCheck = true;
  </code></pre>
  
  <p>Am I missing anything in the code or MQ configuration?</p>
  
  <p>UPDATE 1:
  I found that the error was due to incorrect path to key database. I had mentioned the path till folder name where the certificates were placed. However it was expected to be the folder name followed by the name of kdb file without extention.</p>
  
  <p>After doing this change, the 2538 error is gone. But now I am getting 2059 error with below error message in log.</p>
  
  <p>"The CipherSpec negotiated during the SSL handshake does not match the required CipherSpec for channel..."</p>
  
  <p>My Channel is configured to have"TLS_RSA_WITH_AES_256_CBC_SHA256" as I have set in the MQ Explorer. The client code is also sending the same cipher spec. Still it gives 2059 error.</p>
  
  <p>UPDATE 2: As suggested by @JoshMc, I set the group policy and it resolved above error. Then I started getting error "Channel is lacking certificate".</p>
  
  <p>UPDATE 3: This error is gone after I changed the SSLCAUTH to OPTIONAL. Earlier it was set to REQUIRED. Thanks to @JoshMc for pointing out.</p>