PH22986: THE RENEWED CERTIFICATE IS NOT HONORED WHEN CERTIFICATE EXPIRATION MONITOR RENEWED A CERTIFICATE.

APAR status

• Closed as program error.

Error description

• Even if Certificate Expiration Monitor renewed certificates
  which are expired or about to expire, WebSphere Application
  Server continues using original certificates for SSL
  connection and later SSL connections start failing due to
  expired certificate.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: Certificate Expiration Monitor          *
  *                      may fail reinitializing SSL             *
  *                      configuration after renewing            *
  *                      certificates.                           *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When the dynamic configuration update in SSL is enabled, if
  Certificate Expiration Monitor renewes certificates which are
  expired or about to expire, the renewed certificates are
  available immediately without recycling the servers.
  However, under some condition, the WebSphere Application Server
  security code may fail to reconfigure the SSL configuration in
  order to use the renewed certificates. As a result, the
  affected server keeps using the old certificates for SSL
  connections.
  Once the old certificate expires, the SSL connections which use
  this certificate starts failing.
  

Problem conclusion

• With this fix, when Certificate Expiration Monitor update any
  certificate, the core security code reinitializes the SSL
  configuration for applying the renewed certificates.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.18 and 9.0.5.4.  For more information, see
  'Recommended Updates for WebSphere Application Server':
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP