PH24493: SSL0209E WITH IHS 9.0.5.2 AND LATER

PH24493: SSL0209E with IBM HTTP Server 9.0.5.2 and later (GSKit upgrade to 8.0.55.15)

APAR status

• Closed as program error.

Error description

• SSL0209E with IHS 9.0.5.2 and later
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server                *
  ****************************************************************
  * PROBLEM DESCRIPTION: SSL handshakes in 9.0.5.2 or later      *
  *                      fail with SSL0209E in the error_log.    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  If a TLS 1.3 connection is established then resumed on a new
  connection, and the cipher used is TLS_AES_256_GCM_SHA384,
  GSKit can fail and return GSK_ERROR_CRYPTO which results in IHS
  logging an SSL0209E error.
  Note: Many other causes of SSL0209E exist.
  

Problem conclusion

• GSKit will be updated to 8.0.55.15 or later to address the
  issue.
  
  In the meantime, an easy circumvention exists:
  
  SSLCipherSpec TLS13 -TLS_AES_256_GCM_SHA384
  
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix packs 9.0.5.4.  For more information,
  see 'Recommended Updates for WebSphere Application Server':
  http://www.ibm.com/support/docview.wss?
  rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R900 PSY

     UP