PH48637: SSL CONFIGURATION BUILT FROM JVM PROPERTIES NOT TAKING FIPS INTO ACCOUNT WHEN FILLING IN SSL PROTOCOL.

APAR status

• Closed as program error.

Error description

• SSL configuration built from jvm properties not taking FIPS into
  account when filling in SSL protocol. The failure message is as
  follows:
  [8/10/22 12:04:20:393 CDT] 00000001 ContainerHelp E   WSVR0501E:
  Error creating component null [class
  com.ibm.ws.security.core.SecurityComponentImpl]
  java.lang.ExceptionInInitializerError
  	at java.lang.J9VMInternals.ensureError(J9VMInternals.java:145)
  	at java.lang.J9VMInternals.recordInitializationFailure(J9VMInt
  ernals.java:134)
  	at java.lang.Class.forNameImpl(Native Method)
  	at java.lang.Class.forName(Class.java:339)
  	at
  java.security.Provider$Service.getImplClass(Provider.java:1645)
  	at
  java.security.Provider$Service.newInstance(Provider.java:1603)
  	at
  sun.security.jca.GetInstance.getInstance(GetInstance.java:248)
  	at
  sun.security.jca.GetInstance.getInstance(GetInstance.java:218)
  	at javax.net.ssl.SSLContext.getInstance(SSLContext.java:30)
  ...
  Caused by: java.lang.IllegalArgumentException: Only
  TLS1.0/TLS1.1/TLS1.2 protocol can be enabled when SP800_131
  transition mode or IBMJSSE2 enabled to run in FIPS mode
  	at com.ibm.jsse2.m.a(m.java:23)
  	at com.ibm.jsse2.bf$l.<clinit>(bf$l.java:4)
  

Local fix

• Do not code TLSv1.3. Set the system property
  com.ibm.ws.ssl=TLSv1.2 only.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: When a SSLContext is being built from   *
  *                      the                                     *
  *                      java system properties and FIPS is      *
  *                      enabled the protocol is set             *
  *                      incorrectly.                            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The SSLContext is not created with the correct SSL protocols
  when
  the context is created from the java keystore system
  properties.
  

Problem conclusion

• Fixed the code to consider the FIPS setting when creating a
  SSLContext from java keystore properties.
  
  
  
  The fix for this APAR is targeted for inclusion in fix pack. For
  8.5.5.23 and 9.0.5.14 more information, see 'Recommended Updates
  for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels