PH50353: USAGE METERING NOT HANDLING MULTIPLE SSL PROTOCOL

APAR status

• Closed as program error.

Error description

• An SSL error is seen in Usage Metering because not all SSL
  protocols listed in the configuration are being setup on the
  connection. It was also found that configured cipher suites are
  not being setup on the connection either.
  
  Received fatal alert: protocol_version (
  "throwable" : {
    javax.net.ssl.SSLHandshakeException: Received fatal alert:
  protocol_version
          at com.ibm.jsse2.g.a(g.java:43)
          at com.ibm.jsse2.g.a(g.java:20)
          at com.ibm.jsse2.bb.a(bb.java:150)
          at com.ibm.jsse2.g$c.consume(g$c.java:18)
          at com.ibm.jsse2.bb.a(bb.java:64)
          at com.ibm.jsse2.a0.a(a0.java:7)
          at com.ibm.jsse2.bj.b(bj.java:142)
          at com.ibm.jsse2.bj.f(bj.java:165)
          at com.ibm.jsse2.bj.a(bj.java:338)
          at com.ibm.jsse2.bj.startHandshake(bj.java:519)
          at
  org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayere
  dSocket(SSLConnectionSocketFactory.java:436)
          at
  org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocke
  t(SSLConnectionSocketFactory.java:384)
          at
  org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.co
  nnect(DefaultHttpClientConnectionOperator.java:142)
          at
  org.apache.http.impl.conn.PoolingHttpClientConnectionManager.con
  nect(PoolingHttpClientConnectionManager.java:376)
          at
  org.apache.http.impl.execchain.MainClientExec.establishRoute(Mai
  nClientExec.java:393)
          at
  org.apache.http.impl.execchain.MainClientExec.execute(MainClient
  Exec.java:236)
          at
  org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec
  .java:186)
          at
  org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:
  89)
          at
  org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec
  .java:110)
          at
  org.apache.http.impl.client.InternalHttpClient.doExecute(Interna
  lHttpClient.java:185)
          at
  org.apache.http.impl.client.CloseableHttpClient.execute(Closeabl
  eHttpClient.java:83)
          at
  org.apache.http.impl.client.CloseableHttpClient.execute(Closeabl
  eHttpClient.java:108)
          at
  com.ibm.ws.usage.metering.common.MeteringMetadata.executeRequest
  (MeteringMetadata.java:172)
          at
  com.ibm.ws.usage.metering.common.MeteringMetadata.getToken(Meter
  ingMetadata.java:228)
          at
  com.ibm.ws.usage.metering.common.RegisterTask.register(RegisterT
  ask.java:207)
          at
  com.ibm.ws.usage.metering.common.RegisterTask.run(RegisterTask.j
  ava:106)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  with IBM WebSphere Automation               *
  ****************************************************************
  * PROBLEM DESCRIPTION: Usage metering feature not including    *
  *                      TLSv1.3 support by default              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The usage metering feature of IBM WebSphere Application Server
  that reports registration and usage metrics to IBM WebSphere
  automation does not include TLSv1.3 support by default, nor does
  it support the configuration of multiple protocols.  This may
  result in an SSLHandshakeException if IBM WebSphere Automation
  has been configured to support TLSv1.3 or multiple protocols.
  The exception would be similar to:
  javax.net.ssl.SSLHandshakeException: Received fatal alert:
  protocol_version
  at com.ibm.jsse2.g.a(g.java:43)
  at com.ibm.jsse2.g.a(g.java:20)
  at com.ibm.jsse2.bb.a(bb.java:150)
  at com.ibm.jsse2.g$c.consume(g$c.java:18)
  at com.ibm.jsse2.bb.a(bb.java:64)
  at com.ibm.jsse2.a0.a(a0.java:7)
  at com.ibm.jsse2.bj.b(bj.java:142)
  at com.ibm.jsse2.bj.f(bj.java:165)
  at com.ibm.jsse2.bj.a(bj.java:338)
  at com.ibm.jsse2.bj.startHandshake(bj.java:519)
  at
  org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayere
  dSocket(SSLConnectionSocketFactory.java:436)
  at
  org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocke
  t(SSLConnectionSocketFactory.java:384)
  at
  org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.co
  nnect(DefaultHttpClientConnectionOperator.java:142)
  at
  org.apache.http.impl.conn.PoolingHttpClientConnectionManager.con
  nect(PoolingHttpClientConnectionManager.java:376)
  at
  org.apache.http.impl.execchain.MainClientExec.establishRoute(Mai
  nClientExec.java:393)
  at
  org.apache.http.impl.execchain.MainClientExec.execute(MainClient
  Exec.java:236)
  at
  org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec
  .java:186)
  at
  org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:
  89)
  at
  org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec
  .java:110)
  at
  org.apache.http.impl.client.InternalHttpClient.doExecute(Interna
  lHttpClient.java:185)
  at
  org.apache.http.impl.client.CloseableHttpClient.execute(Closeabl
  eHttpClient.java:83)
  at
  org.apache.http.impl.client.CloseableHttpClient.execute(Closeabl
  eHttpClient.java:108)
  at
  com.ibm.ws.usage.metering.common.MeteringMetadata.executeRequest
  (MeteringMetadata.java:172)
  at
  com.ibm.ws.usage.metering.common.MeteringMetadata.getToken(Meter
  ingMetadata.java:228)
  at
  com.ibm.ws.usage.metering.common.RegisterTask.register(RegisterT
  ask.java:207)
  at
  com.ibm.ws.usage.metering.common.RegisterTask.run(RegisterTask.j
  ava:106)
  

Problem conclusion

• The usage metering feature has been updated support the
  
  configuration of multiple protocols and will now default to
  
  include both TLSv1.3 and TLSv1.2.  Usage metering has also been
  
  updated to properly setup the configured cipher suites on the
  
  connection to IBM WebSphere Automation.
  
  
  
  The fix for this APAR is targeted for inclusion in fix pack
  
  8.5.5.23, 9.0.5.15, and 22.0.0.12. For more information, see
  
  'Recommended Updates for WebSphere Application Server':
  
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels