PH01222: TIMEOUT SETTING FOR OCSP ON IBM HTTP SERVER

9.0.0.10: WebSphere Application Server traditional V9.0 Fix Pack 10
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
9.0.0.11: WebSphere Application Server traditional V9.0 Fix Pack 11
9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Enable timeout settings for OSCP responder on IHS
  

Local fix

• Please add below setting in httpd.conf
  
  SSLAttributeSet 336 5 NUMERIC
  
  This configure a 5-second TCP connection timeout for outbound
  HTTP as used by OCSP.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IBM HTTP Server connecting to an   *
  *                  OCSP server                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: There is no explicit default timeout    *
  *                      for connecting to an OCSP server.       *
  ****************************************************************
  * RECOMMENDATION:  Apply this fix if expecting to access OCSP  *
  *                  servers from your IBM HTTP Server.          *
  ****************************************************************
  There was no explicit default timeout for connecting to an
  OCSP server and, especially on the Windows platform, the
  connection attempt could hang for an extended time if it was
  not completed or actively refused.
  

Problem conclusion

• Use a 10 second timeout by default, which can be overridden by
  the new directive:
  SSLOCSPConnectionTimeout.
  
  This fix is targeted for IBM HTTP Server fix packs:
  - 8.5.5.15
  - 9.0.0.10
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP