IT37774: CERTAIN IANA CIPHER SUITE NAMES ARE IGNORED BY HTTP LISTENER.

APAR status

• Closed as program error.

Error description

• IANA (RFC) names of cipher suites can be used to configure
  CipherSpec property of HTTPSConnector. However, it is seen that
  certain ciphers, like TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, are
  ignored when specified in the IANA form.
  

Local fix

• Configure the CipherSpec property by using the openssl
  equivalent name for the cipher ( ECDHE-RSA-AES256-SHA384 is the
  equivalent openssl name for
  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384)
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All Users of IBM App Connect Enterprise V11 and V12 trying to
  configure <span style="background-color:rgb(255, 255,
  255)">CipherSpec property of HTTPSConnector.</span>
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  IANA (RFC) names of cipher suites can be used to configure the
  CipherSpec property of HTTPSConnector. However, it is seen that
  certain ciphers, like TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, are
  ignored when specified in the IANA form.
  
  The work-around is to specify the cipher in the OpenSSL name
  form as on the page https://testssl.sh/openssl-iana.mapping.html
  

Problem conclusion

• The product no longer fails to accept cipher names in IANA form
  when configured on <span style="background-color:rgb(255, 255,
  255)">HTTPSConnector.</span>
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v11.0      11.0.0.14
  v12.0      12.0.2.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0550

Applicable component levels