PI85478: Disable symmetric offload by default when IHS is configured to use a crypto card

8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• The default configuration for IHS with crypto cards should
  have symmetric offload disabled.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IHS 8.0 and 8.5 that are           *
  *                  configured to use a crypto card             *
  ****************************************************************
  * PROBLEM DESCRIPTION: Many crypto cards are not compatible    *
  *                      with symmetric offload, so it           *
  *                      shouldn't be enabled by default.        *
  ****************************************************************
  * RECOMMENDATION:  Apply this fix if using IHS 8.0             *
  *                  or 8.5 with a crypto card.                  *
  ****************************************************************
  Offload of symmetric key operations when SSLPKCSDriver is
  specified should not be automatically enabled. Many
  crypto cards are not compatible with symmetric offload, and
  there is little value in the offload. Symmetric offload is
  now disabled by default but can be restored with:
  "SSLAttributeSet 417 549"
  

Problem conclusion

• The default configuration for IHS with crypto card usage no
  longer has symmetric offload enabled.
  
  This fix is targeted for IBM HTTP Server fix packs:
  - 8.0.0.15
  - 8.5.5.13
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP