PI52054: DFHAM4918 E THE INSTALLATION OF TCPIPSERVICE WEBS2PVS HAS FAILED BECAUSE ITS REQUESTED CIPHER LIST WAS REJECTED

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• After installation of system SSL apar OA47405, CICS is not able
  to use ciphers 01020304050609 even if apar UI27270 was not
  installed to maintain the support of the previous ciphers.
  .
  The SIT parameter ENCRYPTION=SSLV3 is not sufficient to be able
  to use the SSLv3 ciphers.
  .
  CICS uses the default list to build the base set of allowable
  ciphers for ENCRYPTION=SSLV3 and STRONG.  The CIPHERS
  specified on a resource are then compared to this list (and the
  list in DFHSOXC_ to see if they are valid for use.)
  .
  With the System SSL PTF applied 03 (and others) are no longer in
  the default list so CICS needs to change the way it processes
  the available ciphers to be able to allow 03 to be chosen again.
  .
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: The capability to reinstate removed     *
  *                      CIPHERS provided by PI39809 no longer   *
  *                      works after system SSL APAR OA47405 is  *
  *                      applied.                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  PI39809 provided a capability to reinstate removed CIPHERs by
  applying a usermod supplied by IBM support.
  After applying system SSL APAR OA47405, this capability no
  longer works. This is because the default list of 'supported'
  CIPHERs supplied by system SSL (and used by CICS) no longer
  includes CIPHERs 01, 02, 03, 04, 05, 06.
  

Problem conclusion

• CICS has been changed to detect if a usermod version of module
  DFHSOXC is being used. If it is then CICS will support CIPHERs
  01, 02, 03, 04, 05, 06 providing they do not appear in the
  exclude list of DFHSOXC.
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PI48544

• APAR is sysrouted TO one or more of the following:

  UI32938 UI32939

Modules/Macros

• DFHSOSE  DFHSOXC
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R800 PSY UI32938

     UP15/11/20 P F511

• R900 PSY UI32939

     UP15/11/20 P F511

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.