PM78434: PROVIDE END-TO-END TIMEOUTS FOR SSL HANDSHAKES

8.5.0.2: WebSphere Application Server V8.5 Fix Pack 2
8.0.0.6: WebSphere Application Server V8.0 Fix Pack 6
8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15

APAR status

• Closed as new function.

Error description

• Currently handshake timeout is not end to end; consequently any
  handshakes that take an excessive amount of time also hold open
  the thread for that time. It would be useful and more efficient
  of thread usage to be able to set a timer for SSL handshakes to
  help alleviate the thread usage.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IBM HTTP Server with slow-running  *
  *                  handshakes and shortage of webserver        *
  *                  threads.                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: End-to-end SSL Handshake time cannot be *
  *                      effectively limited with the "Timeout"  *
  *                      directive                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Most modules that implement timeouts use the core "Timeout" by
  default and provide a directive to override it.  mod_ibm_ssl
  cannnot override the core Timeout during a handshake, and has no
  way to impose an end-to-end timeout on the handshake.
  

Problem conclusion

• A new directive was added to mod_ibm_ssl:
  
    SSLHandshakeTimeout IOtimeout [end-to-end timeout]
  
  The end-to-end timeout defaults to seconds and accepts "ms" as
  a suffix.
  
  This fix is targeted for IHS fixpacks:
   - 8.0.0.6
   - 8.5.0.2
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS IHS ZOS

• Fixed component ID

  5655I3510

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP