PI88428: CICS TG TO SUPPORT TLSV1.0, TLSV1.1 AND TLSV1.2 PROTOCOLS

CICS Transaction Gateway Desktop Edition V9.2 (all supported platforms)
CICS Transaction Gateway for Multiplatforms V9.2 (all supported platforms)
CICS Transaction Gateway for Multiplatforms V9.2 Fix Pack 2
CICS Transaction Gateway Desktop Edition V9.2 Fix Pack 2

APAR status

• Closed as program error.

Error description

• If client sends TLSv1.2 request, then CICS TG rejects the
  request with javax.net.ssl.SSLHandshakeException and
  resulting in an SSL handshake failure.
  

Local fix

Problem summary

• By default the CICS TG was creating the SSLContext with SSL_TLS,
  which enables SSL V3.0 and TLS 1.0. Hence the CICS TG could not
  accept TLSv1.2 request.
  
  The behavior of CICS TG was as follows :
    A) By default TLSV1.2 was not supported by the CICS TG. CICS
       TG was only allowing SSLv3, TLSv1.0.
    B) If com.ibm.jsse2.sp800-131=strict is set, then only TLSv1.2
       is supported with sp800-131A compliance.
    C) If com.ibm.jsse2.sp800-131=transition is set, then TLSv1.0
       is set
  
  
    D)  If com.ibm.jsse2.sp800-131=transition and
         com.ibm.jsse2.overrideDefaultTLS=true are set, then
        TLSv1.0, TLSv1.1 and TLSv1.2.
  

Problem conclusion

• CICS TG is changed to add default support for TLSv1.2 requests
  and provided the com.ibm.jsse2.overrideDefaultProtocol support
  as mentioned in https://ibm.biz/Bdi5rr
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PI82515

• APAR is sysrouted TO one or more of the following:

  PH35332

Fix information

• Fixed component name

  CICS TRNS GATE

• Fixed component ID

  5724I8103

Applicable component levels

• R910 PSY

     UP