PH55213: WEBSPHERE PLUGIN HOSTVERIFICATIONSTARTUPCHECK PROBLEMS WITH LIBERTY SERVERS CONFIGURED WITH TCPOPTION WAITTOACCEPT="TRUE"

APAR status

• Closed as program error.

Error description

• When the WebSphere WebServer Plug-in is used with backend
  liberty servers with <tcpOption waitToAccept="true"/> in
  server.xml,
  
  the HostVerificationStartupCheck may encounter an SSL error:
  
  ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init
  to example.com:9443 : GSK_ERROR_IO(gsk rc = 406)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  and the WAS WebServer Plug-in               *
  ****************************************************************
  * PROBLEM DESCRIPTION: If a handshake with a backend           *
  *                      application server fails during startup *
  *                      certificate verification, it will cause *
  *                      a 500 error when selected at runtime.   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  After PH48747, certificate hostnames are validated at startup.
  If a SSL handshake error occurs, the transport is partially
  initialized but can never work at runtime. Unfortunately, in
  this
  state the plugin will not try other servers but return the 500
  status.
  

Problem conclusion

• The code was updated to fully initialize the transport even if
  there is an SSL handshake error. At runtime, it can be attempted
  again.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.24 and 9.0.5.17. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels