IBM Support

How To Enable the TLSv1.3 Protocol for a WebSphere Application Server v8.5 and v9.0 Profile on IBM i OS

How To


Summary

How To Enable the TLSv1.3 Protocol for a WebSphere Application Server v8.5 and v9.0 Profile on IBM i OS

Objective

Enable the TLSv1.3 Protocol to improve security of TLS communications.

Environment

IBM i OS
IBM WebSphere Application Server v8.5.5.20 and later & v9.0.5.6 and later
IBM JDK 8.0.6.25 and later
Minimum IBM i Java Group PTF requirements
IBM i 7.5 - N/A
IBM i 7.4 - SF99665 level 10
IBM i 7.3 - SF99725 level 21
Required PASE PTFs:
IBM i 7.5 - N/A
IBM i 7.4 - 5770SS1-SI76893
IBM i 7.3 - 5770SS1-SI76892

Steps

PRE-REQUISITES
- Ensure the minimum WAS v8.5.5.20 or v9.0.5.6 Fix Pack is installed.
STRQSH
cd /QIBM/ProdData/InstallationManager/eclipse/tools
imcl listInstalledPackages -long
Refer to the following IBM documents if you need to update your WAS Fix Pack version to meet the minimum requirements. 
- Ensure the minimum JDK 8.0 SR6 FP25 fix level is installed with the following minimum IBM i Java Group PTF levels and required PASE PTFs.
IBM i 7.5 - N/A
IBM i 7.4 - SF99665 level 10
IBM i 7.3 - SF99725 level 21
Required PASE PTFs:
IBM i 7.5 - N/A
IBM i 7.4 - 5770SS1-SI76893
IBM i 7.3 - 5770SS1-SI76892
- For WAS v8.5, ensure JDK 8.0 is configured for your WAS Profile.
STRQSH
cd /QIBM/ProdData/WebSphere/AppServer/V85/<edition>/bin
managesdk -listEnabledProfile -profileName <profileName>
If you need to change your WAS profile to use JDK 8.0, ensure 5770JV1 Option 17 is installed.
stopServer -profileName <profileName>
managesdk -enableProfile -profileName <profileName> -sdkname 1.8_64 -enableServers
startServer -profileName <profileName
HOW TO ENABLE TLSv1.3 IN WAS V8.5 and V9.0
NOTE:  This document focuses on how to enable only the TLSv1.3 protocol for WebSphere Application Server.  If you would like to configure both the TLSv1.3 and TLSv1.2 protocols for fallback in case the client only supports the TLSv1.2 protocol, please review and follow the steps outlined in the IBM document, How To Enable the TLSv1.3 & TLSv1.2 Protocols for a WebSphere Application Server v8.5 and v9.0 Profile on IBM i OS.

WAS v9.0

The default application server security configuration does not include the 
/QIBM/UserData/WebSphere/AppServer/V9/<Base or ND>/profiles/<profileName>/properties/java.security file.  As a result, the IBM JDK 8.0 64 bit default java.security file (/QOpenSys/QIBM/ProdData/JavaVM/jdk80/64bit/jre/lib/security/java.security) is used.
Since the IBMJCEPlus security provider is enabled with 8.0 SR6 FP25, TLSv1.3 protocol support is available by default with WAS v9.0 Base and ND on the IBM i OS.
Proceed to step 3 to "Configure the WebSphere Application Server instance's inbound/outbound transports to use the TLSv1.3 protocol."

WAS v8.5

1) Enable the IBMJCEPlus JSSE security provider in the WAS profile's java.security file.
WRKLNK '/QIBM/UserData/WebSphere/AppServer/V85/<Express, Base, or ND>/profiles/<profileName>/properties/java.security'
Option 2 to edit.
Modify the list of "security. providers" to the following.  It is required to have the IBMJCEPlus security provider be listed above the IBMJCE provider in order to take advantage of all of the new security features and performance benefits the IBMJCEPlus security provider has to offer.
security.provider.1=com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl
security.provider.2=com.ibm.crypto.plus.provider.IBMJCEPlus
security.provider.3=com.ibm.crypto.provider.IBMJCE
security.provider.4=com.ibm.jsse2.IBMJSSEProvider2
security.provider.5=com.ibm.security.jgss.IBMJGSSProvider
security.provider.6=com.ibm.security.cert.IBMCertPath
security.provider.7=com.ibm.i5os.jsse.JSSEProvider
security.provider.8=com.ibm.security.jgss.mech.spnego.IBMSPNEGO
security.provider.9=com.ibm.security.cmskeystore.CMSProvider
security.provider.10=com.ibm.security.sasl.IBMSASL
security.provider.11=com.ibm.xml.crypto.IBMXMLCryptoProvider
security.provider.12=com.ibm.xml.enc.IBMXMLEncProvider
security.provider.13=org.apache.harmony.security.provider.PolicyProvider
Press F3 twice to exit.
2) Restart the WebSphere Application Server instance.
STRQSH
cd /QIBM/ProdData/WebSphere/AppServer/V85/<Express, Base, or ND>/bin
stopServer -profileName <profileName>
startServer -profileName <profileName>

3) Configure the WebSphere Application Server instance's inbound/outbound transports to use the TLSv1.3 protocol.
  • Open the WebSphere Application Server Integrated Solutions Console and sign in.
  • Go to Security -> SSL certificate and key management -> SSL configurations -> NodeDefaultSSLConfiguration (or CellDefaultSSLConfiguration or whatever SSL configuration is currently being used).
  • Click Quality of Protection (QoP) under Additional Properties.
  • (8.5.5.21+ and 9.0.5.11+ only) Select the Predefined protocols option .
  • Click the drop-down box for the Protocol field and select TLSv1.3.
  • Click the OK button and then the Save link at the top of the page to save the changes to the master configuration.
  • Restart the WebSphere Application Server instance to enable the use of the TLSv1.3 protocol for TLS connections.
    • STRQSH
      cd /QIBM/ProdData/WebSphere/AppServer/<V85 or V9>/<Express, Base, or ND>/bin
      stopServer -profileName <profileName>
      startServer -profileName <profileName>
4)  Update the protocol to TLSv1.3 in the profile's ssl.client.props file.
  • WRKLNK '/QIBM/UserData/WebSphere/AppServer/<version>/<edition>/profiles/<profileName>/properties/ssl.client.props'
  • Option 2 to edit.
  • Locate the "com.ibm.ssl.protocol" property under the SSL Alias "DefaultSSLSettings" and change the value to TLSv1.3.  Set this value to the same value you set the application server protocol to use.
i.e.
com.ibm.ssl.alias=DefaultSSLSettings
com.ibm.ssl.protocol=TLSv1.3
  • After you make the change, press F3 twice to save and exit.
5) The WebSphere Application Server instance will now use the TLSv1.3 protocol with HTTPS connections to the Integrated Solutions Console, WC_adminhost_secure, transport and to the inbound HTTPS, WC_defaulthost_secure, transport.
NOTES:

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000001hDaAAI","label":"WebSphere Application Server-\u003ESSL TLS"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.3.0;7.4.0;7.5.0;and future releases"}]

Document Information

Modified date:
22 July 2022

UID

ibm16487471

Page Feedback