PI49718: IMPROVE ERROR_LOG REPORTING FOR "SSLPROXYENGINE" HANDSHAKE ERROR S

8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
7.0.0.41: WebSphere Application Server V7.0 Fix Pack 41
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
7.0.0.43: WebSphere Application Server V7.0 Fix Pack 43
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
7.0.0.45: WebSphere Application Server V7.0 Fix Pack 45
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
7.0.0.45: Java SDK 1.6 SR16 FP60 Cumulative Fix for WebSphere Application Server
7.0.0.41: Java SDK 1.6 SR16 FP20 Cumulative Fix for WebSphere Application Server
7.0.0.43: Java SDK 1.6 SR16 FP41 Cumulative Fix for WebSphere Application Server
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Improve error_log reporting for "SSLProxyEngine" handshake
  errors
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IBM HTTP Server SSL reverse proxy  *
  *                  functionality (mod_proxy)                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: Most outbound SSL handshake errors      *
  *                      provide very little detail in the IHS   *
  *                      error_log                               *
  ****************************************************************
  * RECOMMENDATION:  Apply this fix if using "SSLProxyEngine"    *
  ****************************************************************
  SSLProxyEngine defers to GSKit for SSL/certificate processing,
  and only surfaces a broad GSKit return code in the IHS
  error_log.
  

Problem conclusion

• SSLProxyEngine was updated to call into GSKit for two
  additional pieces of information during an SSL handshake
  failure. These two pieces of string data are added to the
  error_log and may help determine:
  
  1) The certificate in the servers chain that had a problem
  2) The validation error itself
  
  This fix is planned for IBM HTTP Server fix packs:
  
   - 9.0.0.0-PI49954 (z/OS 2.2 only)
   - 8.5.5.9
   - 8.0.0.12
   - 7.0.0.41
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R700 PSY

     UP

• R800 PSY

     UP

• R850 PSY

     UP