PH66648: Remove CBC ciphers from IHS TLSv12 defaults where stronger alternatives exist

APAR status

• Closed as program error.

Error description

• Remove CBC ciphers from IHS TLSv12 defaults where stronger
  alternatives exist
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server                *
  ****************************************************************
  * PROBLEM DESCRIPTION: Remove CBC ciphers from IHS TLSv12      *
  *                      defaults where stronger alternatives    *
  *                      exist.                                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When SSL is enabled, each protocol has a list of default SSL
  ciphers that change over time.
  CBC ciphers are increasingly being reported as weak and should
  be removed from the defaults, where
  feasible.
  

Problem conclusion

• The built-in defaults were updated to remove CBC-based
  ciphers  from any protocol where there were stronger
  alternatives in the defaults.
  
  On AIX/Linux/Windows, this means CBC ciphers were removed
  from the defaults on TLS 1.2, leaving GCM based ciphers
  enabled by default.  Older protocols remain disabled by
  defaul, but are unchanged because they do not have stronger
  ciphers available.
  
  IHS on zOS has special considerations:
  
  1. In IHS 9.0, this change only affects the defaults
  when ICSF is being used and affects SSLV3, TLSv10,
  and TLSv11 as well as TLSv12 although protocols older
  than TLSv12 are already disabled by default.
  
  2. In IHS 8.5, this change has no affect, because the defaults
  are not conditional upon ICSF and only CBC ciphers are
  enabled by default.  If IHS 8.5 is in use on zOS, explicit
  SSL configuration is recommended.
  
  IHS can show the defaults, incorporating ICSF checks, by
  running
  `apachectl -t -DDUMP_SSL_CONFIG`.
  
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server
  fix packs 8.5.5.29 and 9.0.5.25. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels