PH31409: CAN'T SET SSLV3TIMEOUT WITH TLS13

APAR status

• Closed as program error.

Error description

• After setting SSLv3Timeout 0 in 9.0.5.4 and later,
  
   SSL0161E:
  Initialization error, The attribute has an invalid numeric
  value: gsk_attrib_set_numeric_value(env_handle,
  GSK_SSL_EXTN_SESSIONTICKET_KEY_LIFETIME)^M
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IBM HTTP Server with errors        *
  *                  referencing                                 *
  *                  "GSK_SSL_EXTN_SESSIONTICKET_KEY_LIFETIME"   *
  ****************************************************************
  * PROBLEM DESCRIPTION: IHS 9.0.5.4 and later fails to start    *
  *                      with "SLV3Timeout 0".                   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  IHS 9.0.5.4 and later fails to start with "SLV3Timeout 0".
  The SSLv3Timeout is incorrectly applied to a part of TLSv13
  configuration, but this specific part cannot be specified
  with a value of zero.
  

Problem conclusion

• The code was updated to disable session tickets when
  "SSLv3Timeout 0" since a zero-lifetime ticket is not
  supported by GSKit.
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix packs 9.0.5.7. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels