PH66134: ENABLE SSL SESSION REUSE BETWEEN THE APPLICATION SERVER AND WEBSPHERE WEBSERVER PLUG-IN OVER TLSV12 ON ZOS

APAR status

• Closed as program error.

Error description

• Enable SSL session reuse between the application server and
  WebSphere WebServer Plug-in over TLSv12 on zOS
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  on z/OS with the WebSphere WebServer Plug-  *
  *                  in                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION: SSL connections between the Plug-in and *
  *                      Application Server are all "full"       *
  *                      handshakes rather than "resumed"        *
  *                      handshakes.                             *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  TLS supports a concept of session resumption, which allows the
  parameters of as recent handshake to be re-used saving some
  expensive cryptography on both sides.
  When making a new TLS connection to WebSphere, the WebSphere
  WebServer Plug-in does not give enough information to System SSL
  to allow it to use cached info from other recent connections to
  the same backend server.  See GSK_PEER_ID in the System SSL
  programming reference.
  

Problem conclusion

• The code was updated to get/set GSK_PEER_ID based on the backend
  server selected. An existing debug-level message is extended to
  communicate if an SSL session is "NEW" or "REU" (reused):
  
  DEBUG: SSL handshake to localhost:9443 complete TLSv13,1302,REU
  
  Note on TLSv13: There are some additional restrictions on TLSv13
  (default off) session resumption in the zOS programming guide
  that are not covered by this APAR.  If TLS13 is enabled and
  negotiated, session reuse may not occur, depending on how the
  server sends the PSK to the client (key_share extension appears
  to work, but if the keys are sent in post-handshake
  new_session_ticket messages they will not resumable)
  
  
  The fix for this APAR is targeted for inclusion in fix pack
  9.0.5.24. For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels