SI57332 - OSP-COMM-SSL Allow TLSv1.2 in System SSL default

TYPE PROGRAM  REL  NUMBER   MIN/MAX  OPTION
---- -------- ---  -------  -------  ------
PRE  5770999  710  MF60335   00/00    0000
PRE  5770999  710  MF58003   00/00    0000
PRE  5770999  710  MF56395   00/00    0000
PRE  5770999  710  MF56200   00/00    0000
PRE  5770999  710  MF56706   00/00    0000
CO   5770SS1  710  SI48648   00/00    0000
CO   5770SS1  710  SI48649   00/00    0000
CO   5770SS1  710  SI48647   00/00    0000
DIST 5770SS1  710  SI48539   NONE     0013
DIST 5770TC1  710  SI49096   NONE     0000
DIST 5770DG1  710  SI48934   NONE     0000



NOTICE:
-------
Application of this PTF may disable or render ineffective programs that
use system memory addresses not generated by the IBM translator,
including programs that circumvent control technology designed to limit
interactive capacity to purchased levels.  This PTF may be a prerequisite
for future PTFs.  By applying this PTF you authorize and agree to the
foregoing.

This PTF is subject to the terms of the license agreement which
accompanied, or was contained in, the Program for which you are obtaining
the PTF.  You are not authorized to install or use the PTF except as part
of a Program for which you have a valid Proof of Entitlement.

SUBJECT TO ANY WARRANTIES WHICH CAN NOT BE EXCLUDED OR EXCEPT AS EXPLICITLY
AGREED TO IN THE APPLICABLE LICENSE AGREEMENT OR AN APPLICABLE SUPPORT
AGREEMENT, IBM MAKES NO WARRANTIES OR CONDITIONS EITHER EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OR CONDITIONS OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON INFRINGEMENT,
REGARDING THE PTF.

The applicable license agreement may have been provided to you in printed
form and/or may be viewed using the Work with Software Agreements (WRKSFWAGR)
CL command.





APAR Error Description / Circumvention

-----------------------------------------------
Customer is unable to get 3rd party application updated to
support the TLSv1.2 protocol.  The need exists to make
applications coded to use the default protocol use TLSv1.2 at a
system level to get around the 3rd party.

CORRECTION FOR APAR SE62307 :
-----------------------------
TLSv1.2 and TLSv1.1 can be added to the System SSL eligible
default protocol list using System Service Tools (SST) Advanced
Analysis Command SSLCONFIG.

The intersection of the System SSL eligible default protocol
list and the QSSLPCL system value list of enabled protocols
determines the System SSL default protocol list used by
applications.

For applications using the deprecated SSL_ interface, this value
indicates the application is using the system default protocol
list:
SSL_VERSION_CURRENT set on either the SSL_Init_Application() or
SSL_Handshake() API.

For GSKit, when TLSv1.2 is added to the System SSL eligible
default protocol list, TLSv1.2 will be supported for the
application as long as gsk_attribute_set_enum() has not been
called with GSK_PROTOCOL_TLSV1_OFF as the value.

To change the System SSL System SSL eligible default protocol
list with the Start System Service Tools (STRSST) command,
follow these steps:

1. Open a character-based interface.
2. On the command line, type STRSST.
3. Type your service tools user name and password.
4. Select option 1 (Start a service tool).
5. Select option 4 (Display/Alter/Dump).
6. Select option 1 (Display/Alter storage).
7. Select option 2 (Licensed Internal Code (LIC) data).
8. Select option 14 (Advanced analysis).
9. Select option 1 (SSLCONFIG).
10. Enter -h

This will show the help screen that describes the input
strings
to change the System SSL setting for
-eligibleDefaultProtocols.

CIRCUMVENTION FOR APAR SE62307 :
--------------------------------
Change the application code to request TLSv1.2 explicitly.


Activation Instructions


None.




Special Instructions


None.


Default Instructions

THIS PTF CAN BE APPLIED IMMEDIATE OR DELAYED.



Supersedes

PTF/FIX NO(S).  APAR TITLE LINE
--------------  ------------------------------------------------------------
   SI52214      OSP-COMM GSKit GSK_SSL_EXTN_SERVERNAME_REQUEST on session
   SI49912      OSP-COMM-OTHER GSKit Interface Fix
   SI49674      OSP-OTHER-PERFM QTSMTPCLTP JOBS HUNG ON SSL INITIALIZATION
   SI49546      OSP-OTHER-INCORROUT UNABLE TO MAINTAIN THE LOCALE FOR THE DE
   SI48534      OSP-COMM TLSv1.2 System SSL Support

Summary Information

System i Support