IT35319: The OCSPTimeout and SSLHTTPConnectTimeout parameters are not read correctly from the configuration file

APAR status

• Closed as program error.

Error description

• If one of both of the OCSPTimeout or SSLHTTPConnectTimeout
  parameters are set in the SSL stanza of the qm.ini or
  mqclient.ini configuration file, they may not be read correctly,
  resulting in unexpected values being set for these parameters.
  
  In the case of the OCSPTimeout, if this issue causes the
  parameter to be set to 0, this can result in the connection to
  the OCSP endpoint being terminated prematurely, before the OCSP
  request is sent to the responder, resulting in unexpected errors
  being encountered during OCSP certificate validation.
  

Local fix

• In the OCSPTimeout case, removing this property from the
  configuration file will result in the default value of 30
  seconds being used.
  
  Removing SSLHTTPConnectTimeout from the configuration file will
  cause the OS/network defined TCP timeout to be used.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of MQ who have configured OCSPTimeout or
  SSLHTTPConnectTimeout in the SSL stanza of a client or queue
  manager configuration file.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  When the OCSPTimeout and SSLHTTPConnectTimeout parameters were
  read from the configuration file, they were read incorrectly
  into an uninitialized buffer.
  
  Depending on the contents of the uninitialized buffer, it was
  possible for this to alter the value read from the configuration
  file, resulting in an incorrect value being used.
  

Problem conclusion

• The MQ configuration file parsing logic has been updated so that
  the relevant buffer is initialized prior to reading these
  values.
  
  Additionally, the handling of the OCSPTimeout parameter has been
  clarified such that setting a value of '0' will result in the
  default timeout of 30 seconds being used.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.2 LTS   9.2.0.2
  v9.x CD    9.2.3
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.2

• Fixed component ID

  5724H7281

Applicable component levels