PM00803: INTERMITTENT PROBLEMS USING THE CORRECT CERTIFICATE WHEN SPECIFIC CERTIFICATE IS SELECTED AT CONNECTION END POINT

Fixes are available

APAR status

Closed as program error.

Error description

The server was defined to use the default SSL configuration at
Node level - NodeDefaultSSLSettings. However, this configuration
was overwritten at one end point - WC_defaulthost_secure to use
a
different personal cert on the keyring. As a result, the server
sometimes would pick up the correct certificate defined for the
end point, and sometimes incorrect one - the default one at the
node level ignoring the override.

The error occurs when the SSL properties are loaded from the
thread. In this situation, the SSL properties for the
NodeDefaultSSLSettings configuration is being loaded instead of
the SSL properties for the newly defined SSL configuration.
This problem can be intermittent and it depends on what request
was handled on that same thread.  For example, for this
outbound request,

{com.ibm.ssl.remotePort=12345, com.ibm.ssl.direction=outbound,
com.ibm.ssl.remoteHost=localhost, com.ibm.ssl.endPointName=ADMI
N_IPC}

the SSL settings were saved on the thread as follows,

 Trace: 2009/10/28 00:54:28.946 01 t=8BA250 c=UNK key=S2
(13007002)
   ThreadId: 00000022
   FunctionName: setSSLPropertiesOnThread
   SourceId: com.ibm.websphere.ssl.JSSEHelper
   Category: FINER
   ExtendedMessage: Entry; Setting thread properties:
NodeDefaultSSLSettings

Then for the actual inbound request to the
WC_defaulthost_secure, it can be seen that it is being
dispatched on the same thread 8BA250, for which the SSL
settings are read,

 Trace: 2009/10/28 00:58:07.732 01 t=8BA250 c=UNK key=S2
(13007002)
   ThreadId: 00000022
   FunctionName: getProperties
   SourceId: com.ibm.websphere.ssl.JSSEHelper
   Category: FINER
   ExtendedMessage: Entry; Special_SSL_Conf,
{com.ibm.ssl.remotePort=12346, com.ibm.ssl.direction=inbound,
com.ibm.ssl.remoteHost=*,
 com.ibm.ssl.isWebContainerInbound=false,
com.ibm.ssl.endPointName=WC_defaulthost_secure}, <null>
...

 Trace: 2009/10/28 00:58:07.733 01 t=8BA250 c=UNK key=S2
(13007002)
   ThreadId: 00000022
   FunctionName: getSSLPropertiesOnThread
   SourceId: com.ibm.websphere.ssl.JSSEHelper
   Category: FINER
   ExtendedMessage: Entry; Found thread properties:
NodeDefaultSSLSettings

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server V7.0                                 *
****************************************************************
* PROBLEM DESCRIPTION: For WebSphere Application Server, the   *
*                      secure default host is set to use a     *
*                      specific SSL alias, but the SSL         *
*                      connection is created using the         *
*                      properties from the                     *
*                      NodeDefaultSSLSettings configuration    *
*                      instead.                                *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
For WebSphere Application Server, the error occurs when the SSL
properties are loaded from the thread. In this situation, the
SSL properties for the NodeDefaultSSLSettings configuration is
being loaded instead of the SSL properties for the newly
defined SSL configuration. This problem can be intermittent
and it depends on what request was handled on that same
thread. The observed symptom is that a secure web page cannot
be accessed.  When the SSL=all trace option is specified, the
following message is displayed regardless of the SSL setting
that was configured,

ThreadId: 00000123
FunctionName: getSSLPropertiesOnThread
SourceId: com.ibm.websphere.ssl.JSSEHelper
Category: FINER
ExtendedMessage: Entry; Found thread properties:
NodeDefaultSSLSettings

Problem conclusion

The code was modified such that for an inbound SSL connection,
the SSL properties used to perform a handshake are not
retrieved from the thread.

APAR PM00803 is currently targeted for inclusion in Service
Level (Fix Pack) 7.0.0.9 of WebSphere Application Server V7.0.

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PM00803
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-11-09
Closed date
2010-01-11
Last modified date
2010-04-03

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R700 PSY UK55133
UP10/03/26 P F003

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
25 October 2021

Tips

PM00803: INTERMITTENT PROBLEMS USING THE CORRECT CERTIFICATE WHEN SPECIFIC CERTIFICATE IS SELECTED AT CONNECTION END POINT

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY UK55133

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?