IV55934: TLSV1.2 FAILED TO WORK WITH RSA CIPHER SUITE IN FIPS MODE.

APAR status

• Closed as program error.

Error description

• Error Message: SSL server failed to work with RSA cipher suite
  after upgrading to Java70 SR6 FP1.
  The following exception was thrown:
      main, called closeSocket()
      main, handling exception:
  javax.net.ssl.SSLHandshakeException: Invalid Padding length: 111
  This happens only for TLSv1.2 in FIPS mode.
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• The TLSv1.2 RSA premaster secret algorithm
  "IbmTls12RsaPremasterSecret" was missed during the integration
  of "Enhance TLS connections".
  

Problem conclusion

• This APAR will be fixed in the following Java Releases:
     7    SR7       (7.0.7.0)
     6    SR16      (6.0.16.0)
     6 R1 SR8       (6.1.8.0)
     7 R1 SR1       (7.1.1.0)
  .
  Added "IbmTls12RsaPremasterSecret" to "Enhance TLS connections"
  fix.
  The associated Austin CMVC defect is 115305.
  The associated RTC Problem Report is 59804.
  Platform affected: All platforms.
  JVMs affected: 6.0, 6.26, 7.0, and 7.27.
  Jars affected: ibmjsseprovider2.jar.
  The fix will be available in 160_SR15_FP2, 626_SR8, and 170_SR7,
  and 727_SR1.
  Build level is 20140221.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R260 PSY

     UP

• R600 PSY

     UP