IT17934: HANG OR SLOWNESS IN SSL/TLS CHANNELS DUE TO DELAYS IN CCIGSK_ENVIRONMENT_INIT

APAR status

• Closed as program error.

Error description

• Unexpected delays are observed when starting MQ channels using
  SSL/TLS. MQ trace captured during the problem likely to show
  very long delays in ccigsk_environment_init functions.
  
   16:17:16.194912     1801.1      RSESS:000001
  ------{ccigsk_environment_init
   16:17:16.194921     1801.1      RSESS:000001
  gsk_environment_init:input: gsk_env_handle=0x1001758d0
  *16:17:26.028585     1801.4           :       -}!
  xcsWaitThreadEventrc=xecL_W_TIMEOUT
   16:17:26.028603     1801.4           :
  -{xcsRequestThreadMutexSem
  
  The cause of the delay was in the GSKit libraries used by MQ for
  cryptographic operations, however MQ did not support the setting
  of tuning parameters which the GSKit support team recommended to
  use as part of the diagnosis of this delay.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users using MQ SSL channel in Fujitsu SPARC Servers.
  
  
  Platforms affected:
  Solaris x86-64, Solaris SPARC
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  This problem occurred because of delays in GSKit cryptographic
  processing.
  
  The GSKit team recommended tuning parameters as part of their
  investigation, however MQ did not support the passing through of
  these parameters to the GSKit libraries.
  

Problem conclusion

• MQ has been modified to pass the following environment variables
  and values through to the GSKit libraries if set:
  
       AMQ_SSL_FIPS_MODE_PROCESSING_OFF=1
       AMQ_SSL_NOLOAD_C=1
  
  
  These environment variables should be set only if recommended by
  IBM support.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v7.5       7.5.0.8
  v8.0       8.0.0.7
  v9.0 CD    9.0.3
  v9.0 LTS   9.0.0.2
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE MQ 7.

• Fixed component ID

  5724H7240

Applicable component levels