PH38091: ADD SUPPORT FOR DEFAULTCIPHERS.XML

APAR status

• Closed as new function.

Error description

• Add support to CICS TS 5.6 for use of defaultciphers.xml on
  EXEC CICS WEB OPEN and EXEC CICS INVOKE SERVICE commands.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users                               *
  ****************************************************************
  * PROBLEM DESCRIPTION: Add support for defaultciphers.xml      *
  *                      on EXEC CICS WEB OPEN and EXEC CICS     *
  *                      INVOKE SERVICE commands                 *
  ****************************************************************
  A CICS application makes an outbound HTTPS request using an EXEC
  CICS WEB OPEN or EXEC CICS INVOKE SERVICE command.  If the
  command does not specify a list of ciphers to use via the
  CIPHERS or URIMAP parameters, then CICS will use a default list
  of 2 digit ciphers.  That list is currently 3538392F3233.
  
  If the target endpoint no longer supports any of the ciphers
  from the CICS default list the outbound request will fail.
  
  In many cases it is not easy or possible to update every
  affected CICS application to use a URIMAP and a suitable cipher
  file.
  
  This APAR was raised to provide a default cipher file to replace
  the default list of 2 digit ciphers.
  

Problem conclusion

Temporary fix

Comments

• CICS has been updated to add support for a defaultciphers.xml
  file on EXEC CICS WEB OPEN and EXEC CICS INVOKE SERVICE
  commands.
  
  A sample defaultciphers.xml file is provided in the
  USSHOME/security/ciphers directory.  It should be copied to the
  USSCONFIG/security/ciphers directory and customised to meet
  your security requirements.
  
  To make use of the defaultciphers.xml file you need to set the
  following feature toggle;
  
    com.ibm.cics.web.defaultcipherfile=true
  
  If the feature toggle is set then the defaultciphers.xml file
  will be processed during CICS initialization.  If there is a
  problem with the file then message DFHWB0112 will be issued and
  CICS will revert to using the existing default list of 2 digit
  cipher suites.
  
  
  The CICS TS 5.6 documentation will be updated to describe the
  new feature toggle and document message DFHWB0112.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI76260 PH45703

Modules/Macros

• DFHMEWBC DFHMEWBE DFHMEWBK DFHWBCL  DFHWBDM  DFHWBDUF DFJ@H606
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels