PI82515: CICS TG TO SUPPORT TLSV1.0, TLSV1.1 AND TLSV1.2 PROTOCOLS

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• If client sends TLSv1.2 request, then CICS TG rejects the
  request with javax.net.ssl.SSLHandshakeException and
  resulting in an SSL handshake failure.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of CICS TG for z/OS.               *
  ****************************************************************
  * PROBLEM DESCRIPTION: If client sends TLSv1.2 request, then   *
  *                      CICS TG rejects the request with        *
  *                      javax.net.ssl.SSLHandshakeException     *
  *                      and resulting in an SSL handshake       *
  *                      failure.                                *
  ****************************************************************
  * RECOMMENDATION: As a workaround                              *
  *                 Set either of the following options in       *
  *                 CTGSTART_OPTS to enable TLSv1.2.             *
  *                 i.  -j-Dcom.ibm.jsse2.sp800-131=strict       *
  *                 ii. -j-Dcom.ibm.jsse2.overrideDefaultTLS     *
  *                 =true -j-Dcom.ibm.jsse2.sp800-131=transition *
  ****************************************************************
  By default the CICS TG was creating the SSLContext with SSL_TLS
  which enables SSL V3.0 and TLS 1.0. Hence the CICS TG could not
  accept TLSv1.2 request.
  
  The behavior of CICS TG was as follows
  A.  By default TLSV1.2 was not supported by the CICS TG. CICS TG
  was only allowing SSLv3, TLSv1.0
  B.  If we set com.ibm.jsse2.sp800-131=strict, then only TLSv1.2
  is supported with sp800-131A compliance.
  C.  If we set com.ibm.jsse2.sp800-131=transition, then TLSv1.0
  is set.
  D.  If we set com.ibm.jsse2.sp800-131=transition and
  com.ibm.jsse2.overrideDefaultTLS=true, then TLSv1.0, TLSv1.1
  and TLSv1.2
  

Problem conclusion

• CICS TG is changed to add default support for TLSv1.2 requests
  and provided the com.ibm.jsse2.overrideDefaultProtocol support
  as mentioned in https://ibm.biz/Bdi5rr
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI48827 UI48828 PI88428

Modules/Macros

• CTG00199 CTG00201 CTG00204 CTG00974
  

Fix information

• Fixed component name

  CTG V9 FOR Z/OS

• Fixed component ID

  5655Y2000

Applicable component levels

• R910 PSY UI48828

     UP17/07/19 P F707

• R920 PSY UI48827

     UP17/08/02 P F707

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.