PM87247: Additional certificate attributes are needed as fields accessible to the SSLClientAuthRequire directive

8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7
8.5.5.1: WebSphere Application Server V8.5.5 Fix Pack 1
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
8.5.5.2: WebSphere Application Server V8.5.5 Fix Pack 2
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.5.5.3: WebSphere Application Server V8.5.5 Fix Pack 3
8.5.5.4: WebSphere Application Server V8.5.5 Fix Pack 4
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14

APAR status

• Closed as new function.

Error description

• The SSLClientAuthRequire directive should be able to access
  additional certificate attributes to allow more possibilities
  for restricting access by uniquely identifying clients.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM HTTP Server users with SSL enabled and  *
  *                  using the SSLClientAuthRequire directive    *
  ****************************************************************
  * PROBLEM DESCRIPTION: Some certificate attributes were not    *
  *                      available as expected to the            *
  *                      SSLClientAuthRequire directive          *
  ****************************************************************
  * RECOMMENDATION:  Apply this fix if using                     *
  *                  SSLClientAuthRequire and you need the       *
  *                  additional certificate attributes.          *
  ****************************************************************
  Three additional certificate attributes were made available to
  SSLClientAuthRequire:
  Long Name      / Short Name / value
  -------------------------------------------
  FINGERPRINT    / FP         / sha1 fingerprint
  (distributed platforms only)
  FINGERPRINT256 / FP256      / sha256 fingerprint
  (distributed platforms only)
  SERIAL         / SN         / serial number of cert.
  Three corresponding environment variables were also added
  accessible to mod_rewrite, setenvif, and logging:
  - SSL_CLIENT_SERIALNUM
  - SSL_CLIENT_SHA1
  - SSL_CLIENT_SHA256
  The fingerprint format is hex characters with no separator.
  The serial number is hex characters separated by colons.
  

Problem conclusion

• Additional certificate attributes were made available to the
  SSLClientAuthRequire directive.
  
  This fix is targeted for IBM HTTP Server fix packs packs:
   - 8.0.0.7
   - 8.5.5.1
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP