Troubleshooting
Problem
This document contains frequently asked questions as well as video tutorials for the Secure Sockets Layer (SSL) component in the WebSphere® Application Server traditional. This can help address common issues with this component before calling IBM support and save you time.
Resolving The Problem
Runtime: Topic:
This topic contains frequently asked questions for the Secure Sockets Layer (SSL) component in WebSphere Application Server traditional. This can help address common issues with this component before calling IBM support and save you time.
Is SHA-2 Supported in WebSphere Application Server Version v6.0/6.1?
- SHA-2 is not supported in WebSphere Application Server v6.0.
- SHA-256 is supported in WebSphere Application Server v6.1.0.47 using Java SDK 1.5 SR16. If you want to generate a certificate, you can use the keytool utility. Example:
Example: keytool -keystore key.jks -storepass test123 -alias jetty2 -genkey -keyalg RSA -keysize 2048 -sigalg SHA256withRSA
Does the IBM JCE support Diffie-Hellman (DH) key sizes greater than 2048-bits?
It is possible to enforce a DH key size greater than 2048 restriction by setting the system property
jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 2048 |
However, this will result in DH keys not being supported at all as the IBM JCE only supports smaller or equal than 2048 DH keys.
See the following Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server (CVE-2015-4000)
Further information on the jdk.tls.disabledAlgorithms system property can be found in this document in the IBM Documentation
How to customize cryptographic algorithm and cipher suites that your JDK will tolerate?
To customize the cryptographic algorithm and cipher suites your JDK will accept, you need to consider both JDK properties that exist in the java.security file and WebSphere custom properties and their defaults.
Note: This setting is at the JDK level and separate from cipher specifications configured in WebSphere SSL Repertoires. These JDK settings will take precedence over WebSphere SSL Repertoire settings.
These are the JDK properties. See your JDK documentation for further details:jdk.tls.disabledAlgorithms jdk.certpath.disabledAlgorithms |
For users of WebSphere Application Server 7.0.0.41, 8.0.0.13, 8.5.5.10, 9.0.0.0 and above
APAR PI54960 introduced a set of custom properties that will override the previously mentioned JDK properties. These properties are cell-wide settings. If your desire is to affect only individual servers within the cell, you will then need to use JDK java.security capabilities.
com.ibm.websphere.tls.disabledAlgorithms com.ibm.websphere.certpath.disabledAlgorithms |
![](/support/pages/system/files/support/swg/swgtech.nsf/0/d66699f31c8e0d99852580dc005e5c2e/Content/0.2C3C.gif)
How do I enable SSLv3 on fix pack 7.0.0.41, 8.0.0.13, and 8.5.5.10 and above?
In order to enable SSLv3 on the above fix packs, you need to follow these steps depending on the JDK you are using:- For JDK 1.6 and 1.7 users:
com.ibm.websphere.tls.disabledAlgorithms=none
com.ibm.websphere.certpath.disabledAlgorithms=none-Dcom.ibm.jsse2.disableSSLv3=false - Add the following custom properties:
- Enable the following SDK property
- For JDK 1.8 users:
By default at the latest JDK 1.8 maintenance level the below properties are set to the following values:
jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1024
jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize <768, MD5withRSA
Which is why setting the properties to the same value as in the earlier JDK's, won't work. Instead, you will need to set those properties to something like:com.ibm.websphere.tls.disabledAlgorithms=RC4, DH keySize <768 com.ibm.websphere.certpath.disabledAlgorithms=MD2, RSA keySize < 1024
Note: A video showing this step-by-step process is available in the Video Tutorials tab above.
![]() If that's the case, review the following RFC documentation since it will provide you the list of ciphers that you will need to re-enable. Click here A video showing how to manually add ciphers on WebSphere Application Server traditional can be found in the Video Tutorials tab above. |
How to replace WebSphere default certificate from SHA1 certificates to SHA256 Certificates and also Keysize from 1024 to 2048?
During the installation of WebSphere Application Server v7.0, WebSphere creates a default keystore and root CA that has a default 1024-bit key size. With this approach, you upgrade the root CA key size to a 2048-bit root certificate which will increase your security level against potential vulnerabilities. NOTE: This information assumes that you are using a Default SSL configuration and Default SSL keystores. The following steps will not be applicable if you are using any CA certificate or self-signed certificate
Make sure you are using WebSphere Application Server fix pack 7.0.0.23 or above or WebSphere Application Server v8.0, v8.5, v8.5.5, v9.0. The following steps applicable only on WebSphere Application Server fix pack 7.0.0.23 and above See the following steps:
Follow these steps:
![]() To Verify the Changes Open the Admin Console and check the default certificate
For Users who have a configuration that makes SSL connections between a plugin and WebSphere Application Server You also have to propagate the plugin-keykdb from WebSphere Admin Console or you have to add new WebSphere root certificate under signer certificate of plugin-key.kdb because the above change will update the WebSphere root CA certificate with new serial number. ![]()
This happens due to the provider being unable to write out the supporting chain of the new certificate. To work around this, users should discard the changes then go to the "CMSKeyStore" keystore and under that signer certificate remove the certificate with the alias in the message above. Once the certificate is removed the user can attempt to convert the certificates again. Reference: See more PI48460: FAILURE TO CONVERT CERTIFICATES WHEN CMS KEYSTORE IS PRESENT A video showing this step-by-step process is available in the Video Tutorials tab above. |
How can I configure WebSphere Application Server traditional to use multiple SSL protocols TLSv1.1, TLSv1.2 and disable TLSv1.0?
The property jdk.tls.disabledAlgorithms now supports the disabling of cipher suites by naming the cryptographic algorithm to be disabled. The default value for this property is
Learn more: Service Refresh 16 Release Notes
Start by backing up your current configuration. For this you will need to run the backupConfig command. For more information on this command, see the documentation for the https://www.ibm.com/support/knowledgecenter/SSAW57_8.0.0/com.ibm.websphere.nd.multiplatform.doc/info/ae/ae/rxml_backupconfig.html">backupConfig command in the IBM Documentation.
Log in to the WebSphere Application Server Integrated Solutions Console.
You can perform same steps for other SSLconfig such as NodedefaultSSLsetting..etc To disable TLSv.1.0 in order to allow only TLSv1.1 and TLSv1.2, follow these steps: You will need to modify the java.security file. This file is found in the following path depending on your WebSphere Java Path:
![]()
In order to verify that these steps were completed successfully, follow these steps:
|
How do I change default password for all keystores and truststore within WebSphere Application Server?
Attention: Before following the below steps, make sure to back up your WebSphere configuration using the backupConfig commands.
The following example creates a file called myBackup.zip and does not stop any servers before beginning the backup process.
On Unix Platforms:
On Windows Platform
|
To change the default password for all keystores and truststores within your WebSphere Application Server you will need to use the changeMultipleKeyStorePasswords method. This command updates the passwords for each keystores in the configuration that has a specific password.
Run the wsadmin command as follows:
wsadmin.sh -lang jython -user adminUser -password adminPassword |
The changeMultipleKeyStorePasswords method of the AdminTask object will change the passwords of all keystores and truststores with a single command. At the prompt, give the following command:
wsadmin> AdminTask.changeMultipleKeyStorePasswords ['(-keyStorePassword yourCurrentPassword -newKeyStorePassword yourNEWPassword -newKeyStorePasswordVerify yourNEWPassword]') |
For more detail, see the following IBM Documentation KeyStoreCommands command group for the AdminTask object
Sample Command output
C:\WebSpherev7.0\profiles\Dmgr01\bin>wsadmin -lang jython WASX7209I: Connected to process "dmgr" on node RAMCellManager02 using SOAP connector; The type of process is: DeploymentManager WASX7031I: For help, enter: "print Help.help()" wsadmin> wsadmin> wsadmin>AdminTask.changeMultipleKeyStorePasswords('[-keyStorePassword WebAS -newKeyStorePassword my@password -newKeyStorePasswordVerify my@password]') 'CellDefaultKeyStore\r\n CellDefaultTrustStore\r\n CellLTPAKeys\r\n DmgrDefaultRootStore\r\n DmgrDefaultDeletedStore\r\n DmgrDefaultSignersStore\r\n NodeDefaultKeyStore\r\n NodeDefaultTrustStore\r\n CellRSATokenKeyStore\r\n CellRSATokenTrustStore\r\n DmgrRSATokenRootStore\r\n CMSKeyStore' wsadmin> |
How do I configure (step by step) Dynamic Outbound Endpoint SSL to use TLS 1.2?
Follow this three steps process to configure Dynamic Outbound Endpoint SSL to use TLS 1.2.
Step 1: Backing up WebSphere Application Server Config
The following example creates a file called myBackup.zip and does not stop any servers before beginning the backup process:
On Unix Platforms:
On Windows Platform
|
For more information on how to use the backupConfig command visit the IBM Docs Article
For more information on how to use the restoreConfig command visit the IBM Docs Article
Or watch the video: How do I run the backupConfig and restoreConfig scripts in WebSphere Application Server? - YouTube
Note: By default the backupConfig command, will stop the deployment manager, in order to avoid this, use option -nostop. The command will zip the config dir on dmgr profile.
The following steps will use the keystore and truststore that are automatically generated by WebSphere Application Server.
Step 2: Create a MYNEWSSLconfig Secure Sockets Layer configuration with TLSv1.2
For more information visit the following IBM Docs Article: Creating a Secure Sockets Layer configuration
Follow these steps to create a new SSL Config Secure Socket Layer with TLSv1.2
- Create New SSL config
- Select a truststore name from the drop-down list is CelldefaultTruststore
- From the WebSphere administrative console click Security > SSL certificate and key management > Manage endpoint security configurations.
- Select an SSL configuration link on either the Inbound or Outbound tree, depending on the process you are configuring.
- Click SSL configurations under Related Items.
- You can view and select any of the SSL configurations that are configured at this scope. You can also view and select these configurations at every scope that is lower on the topology.
- Click New to display the SSL configuration panel. (MYNEWSSLconfig) You cannot select links under Additional Properties until you type a configuration name
- Select a keystore name from the drop-down list. A keystore contains the personal certificates that represent a signer identity and the private key that WebSphere Application Server uses to encrypt and sign data.
- If you change the keystore name, click Get certificate aliases to refresh the list of certificates from which you can choose a default alias. WebSphere Application Server uses a server alias for inbound connections and a client alias for outbound connections.
- Select a keystore name from the drop-down list is NodeDefaultkeystore or YourOwnKeystore
- Note: You can create and use your own keystore instead of NodeDefaultkeystore but make sure use common truststore which is CelldefaultTruststore also make sure certificate between yourownkeystore and celldefaulttruststore is exchanged.
- Click Get certificate aliases to refresh the list of certificates from which you can choose a certificate alias for your application needs.
- Click Apply save the changes and sync the nodes
- Now configure this new SSL configuration (MYNEWSSLconfig) with protocol TLSv1.2
- SSL Configuration described above, then click Quality of protection (QoP) settings under Additional Properties.
- From the WebSphere administrative console, navigate to SSL certificate and key management > SSL configurations > MYNEWSSLconfig > Quality of protection (QoP) settings
- On the Quality of protection (QoP) settings panel, select TLSv1.2 from the pull-down list in the box named Protocol.
- Change the protocol to TLSV1.2
- Click Apply, then Save.
- Sync the node with dmgr
Step 3: Create a Dynamic outbound endpoint to use new SSL configuration (MYNEWSSLconfig)
Associating a Secure Sockets Layer configuration dynamically with an outbound protocol and remote secure endpoint
- From the administrative console page, click Security > SSL certificate and key management> click Dynamic outbound endpoint SSL configurations.
- Click NEW
- Name: MyOutboundSSL (example)
- Type the connection information that you want to associate with the configuration that is displayed in the SSL configuration drop-down list.
- Under Add connection information given your remote server hostname and port, example:
*,remote_host_address,remote_server_ssl_port - Click Add and Select an SSL configuration from the list.
- Choose MYNEWSSLconfig
- Click Get certificate aliases to refresh the certificate aliases that are contained in the associated keystore.
- Choose a certificate alias from the list.
- Click OK and Save.
- Sync the node with dmgr.
- Restart the application server only.
Does WebSphere traditional support the use of Sun's JSSE or JCE provider in customer applications?
Yes, WebSphere traditional does support the use of Sun's JSSE or JCE provider in customer applications. For more information, review the following technote: Support For Sun's JSSE or JCE Provider In WebSphere Application Server.IBM WebSphere Application Server traditional does not send the full chain to clients
See the technote WebSphere Application Server does not send the full chain to clientsHow do I install the unrestricted policy files in WebSphere Application Server from the IBM Site?
A video showing this step-by-step process is available in the Video Tutorials tab above.How do I use the keytool command to verify the certificate chain for WebSphere Application Server?
A video showing this step-by-step process is available in the Video Tutorials tab above.How to transform PEM and PFX keystore in Public Key Cryptography Standard #12 (PKCS12) keystore - United States
The following technote, explains how can you transform PEM and PFX keystores in PKCS12 keystores: How to transform PEM and PFX keystore in Public Key Cryptography Standard #12 (PKCS12) keystoreHow to re-create the root CA for WebSphere Application Server 7.0 on the deployment manager before creating member nodes
The following technote explains how can you re-create the root CA for WebSphere Application Server 7.0 on the deployment manager before creating member nodes: Re-creating the root CA for WebSphere Application Server 7.0 on the deployment manager before creating member nodesHow to set up SSL from a client to a web server and plugin to WebSphere Application Server?
The following slides go over the necessary steps needed to set up SSL from a client to a web server and plugin to WebSphere Application Server: Setting Up SSL From Client to Web Server and Plugin to WAS
Note:
This document uses the term WebSphere traditional to refer to WebSphere Application Server v9.0 traditional, WebSphere Application Server v8.5 full profile, WebSphere Application Server v8.0 and earlier, WebSphere classic, traditional WebSphere, traditional WAS and tWAS.
Was this topic helpful?
Document Information
Modified date:
12 August 2023
UID
swg21999963