PK98916: JSSEHELPER API METHOD REINITIALIZECLIENTDEFAULTSSLPROPERTIES() IS NOT COMPLETELY REINITIALIZING THE CONFIGURED PROPERTIES.

Fixes are available

APAR status

Closed as program error.

Error description

JSSEHelper API method reinitializeClientDefaultSSLProperties()
is not completely reinitializing the configured properties. The
expected behavior is to completely override a previous SSL
configuration and the current behavior does not refresh the key
stores and trust stores if they already exist.

Local fix

The workaround for this problem is to rename the key store
and/or trust store when reinitializing. For example, specifying
these two new names will cause the reinitialization code to
create the corresponding runtime key stores and trust stores
with the correct file values,

com.ibm.ssl.keyStoreName=PermanentDefaultKeyStore
com.ibm.ssl.keyStore=permanent.store.jks
...
com.ibm.ssl.trustStoreName=PermanentDefaultTrustStore
com.ibm.ssl.trustStore=truststore.jks
...

Please note that the names have to end with "DefaultKeyStore" or
"DefaultTrustStore". This is a documented restriction,

http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?
topic=/c
om.ibm.websphere.nd.doc/info/ae/ae/rsec_sslclientpropsfile.html

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application Server
****************************************************************
* PROBLEM DESCRIPTION: For WebSphere Application Server,       *
*                      the JSSEHelper method                   *
*                      reinitializeClientDefaultSSLProperties( *
*                      ) does not reinitialize existing SSL    *
*                      configurations from the default         *
*                      location for ssl.client.props for a     *
*                      Thin client.                            *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
For WebSphere Application Server, the reinitialization of a
modified SSL configuration in the ssl.client.props or similar
location, as specified by the value of the property
-Dcom.ibm.SSL.ConfigURL, does not reload the keystores and/or
truststores properties if the name of the stores did not
change between modifications. This can result in SSL handshake
errors if the store file name(s), type(s), or provider(s) are
modified since the previously loaded store configuration is
still used for future SSL handshakes.

Problem conclusion

The code was modified to correctly reload the SSL
configuration when invoking the JSSEHelper method
reinitializeClientDefaultSSLProperties()

The fix for this APAR is currently targeted for inclusion in
fix pack 7.0.0.11.  Please refer to the Recommended Updates
page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PK98916
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-10-19
Closed date
2010-02-19
Last modified date
2010-02-19

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R700 PSY
UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 October 2021

Tips

PK98916: JSSEHELPER API METHOD REINITIALIZECLIENTDEFAULTSSLPROPERTIES() IS NOT COMPLETELY REINITIALIZING THE CONFIGURED PROPERTIES.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

Document Information

Share your feedback

Need support?