PH51709: PROVIDE MECHANISM TO REJECT CLIENT CERTIFICATES WITH SMALL RSA KEY SIZES.

APAR status

• Closed as new function.

Error description

• Provide mechanism to reject client certificates with small RSA
  key sizes.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server who want to    *
  *                  configure minimum RSA key sizes in client   *
  *                  certificates.                               *
  ****************************************************************
  * PROBLEM DESCRIPTION: IBM HTTP Server does not provide a way  *
  *                      to require a minimum RSA                *
  *                      Key Size for client certificates.       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  If a page is protected by TLS Client Authentication, the
  administrator may want to require that the clients certificate
  has a large enough RSA key to ensure integrity.
  

Problem conclusion

• This fix adds a new directive, SSLMinimumRSAKeySize.
  
  Example:
  
  SSLMinimumRSAKeySize 2048
  
  On z/OS, this causes a handshake failure if the client
  certificate uses a key smaller than the given argument.
  
  On distributed this checks all client and server certificates,
  including their certificate chains, and fails the handshake if
  any of them use a key smaller than the given argument.
  
  On distributed, two additional environment variables are added:
  
  SSL_CLIENT_KEY_ALG
  SSL_CLIENT_KEY_SIZE
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix packs 9.0.5.15. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels