PH04951: IMAGES IN PDF OUTPUT FAIL TO LOAD IF SERVED VIA TLS1.2 BY MICROSOFT IIS USING SHA256 SIGNED CERTIFICATE

APAR status

• Closed as fixed if next.

Error description

• When rendering a report containing images referenced by absolute
  HTTPS URL to PDF, CA fails to retrieve the images if the server
  hosting the images is supporting TLS1.2 and is strictly RFC 5246
  compliant and uses a non-SHA1 signature on its server
  certificate.
  This is caused by CA NOT sending the signature_algorithms
  extension in ClientHello. This will cause strict implementations
  of TLS1.2 RFC 5246
  to conclude that the client only supports SHA1 and RSA signature
  algorithms and hence the server will close the connection
  instantly as it
  is deemed incompatible.
  

Local fix

• - Disable TLS 1.2 on the IIS. TLS1.1 does not enforce the
  signature-algorithms extension
  - Do not use IIS
  - insert SSL terminating proxy, which uses TLS1.1 to talk to IIS
  - copy images to APPTiers (ref. "Resolving images")
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All Users                                                    *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to IBM Cognos Analytics 11.1.2                       *
  ****************************************************************
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels