PI30323: ADD SUPPORT FOR DUAL-MODE ECDSA/RSA SSL VIRTUAL HOSTS

8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Add support for dual-mode ECDSA/RSA SSL virtual hosts
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM HTTP Server users who wish to use both  *
  *                  ECDSA and RSA ciphers in the same           *
  *                  virtualhost                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: Enable both ECDSA and RSA ciphers in    *
  *                      the same virtualhost.                   *
  ****************************************************************
  * RECOMMENDATION:  Apply this fix if you wish to use both      *
  *                  ECDSA and RSA ciphers in the same           *
  *                  virtualhost.                                *
  ****************************************************************
  Many modern browsers support ECDSA ciphers. However, a special
  ECDSA certificate must be presented by the server to be able to
  negotiate an ECDSA cipher. In older versions of IHS, it is
  not possible to choose to use an ECDSA certificate when
  negotiating an ECDSA cipher.
  

Problem conclusion

• New functionality has been added to SSLServerCert to allow IHS
  to send an ECDSA certificate when an ECDSA cipher is being
  negotiated. The server administrator may specify two
  certificate labels separated by a space. One label must
  correspond to the RSA certificate, the other, the ECDSA
  certificate.
  
  This fix is targeted for IBM HTTP Server fix packs:
  - 8.0.0.11
  - 8.5.5.5
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP