IT46611: TLS IN ACE NEEDS TO BE ABLE TO HANDLE CERTIFICATE CHAINS WITH CERTIFICATES APPEARING IN ANY ORDER

APAR status

• Closed as program error.

Error description

• Prior to rotating the certs on IBM Secret Manager, App Connect
  is able to resolve the full certificate chain but after
  certificate rotation, App Connect produces only partial chain.
  ACE should be able to handle  certificate chains with
  certificates appearing in any order.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All user of App Connect Enterprise v12 who use rotating
  certificates for TLS
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  Prior to TLS 1.3, "certificate_list" ordering required each
  certificate to certify the one immediately preceding it;
  however, some implementations allowed some flexibility. Servers
  sometimes send both a current and deprecated intermediate for
  transitional purposes, and others are simply configured
  incorrectly, but these cases can nonetheless be validated
  properly. For maximum compatibility, all implementations SHOULD
  be prepared to handle potentially extraneous certificates and
  arbitrary orderings from any TLS version, with the exception of
  the end-entity certificate which MUST be first.
  
  The App Connect Enterprise v12 currently does not implement this
  and this will need to be implemented in HTTP listener.
  

Problem conclusion

• The product has been modified such that it can now handle
  Certificate chains with Certificates appearing in any order.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v12.0      12.0.12.5
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0560

Applicable component levels