PH10382: ENABLE TLSV1.2 UNDER SSLFIPSENABLE

9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Unable to use protocol TLSv1.2 with SSLFIPSEnable
  

Local fix

• Enable TLSv1.2
  
  In IHS_ROOT/bin/envvars file
  export GSK_PROTOCOL_TLSV1_2=ON
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IBM HTTP Server on z/OS            *
  ****************************************************************
  * PROBLEM DESCRIPTION: Configurations with SSLFIPSENable       *
  *                      don't allow TLS1.2                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When SSLFIPSEnable is specified, TLS1.2 cannot be negotiated.
  

Problem conclusion

• The code was updated to allow the configured
  SSLProtocolEnable
  directives to affect the set of protocols even when
  SSLFIPSEnable is enabled.
  
  The fix for this issue is targeted for 8.5.5.16 and 9.0.5.1.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS IHS ZOS

• Fixed component ID

  5655I3510

Applicable component levels

• R850 PSY

     UP