PH47941: TWO-ARGUMENT SSLSERVERCERT DOESN'T WORK WITHOUT SNI

APAR status

• Closed as program error.

Error description

• When configuring IHS with "SSLServerCert cert1 cert2", "cert2"
  can only be selected if the client sends TLS SNI information
  that matches the SNI configuration.
  
  Due to another bug, SNI
  processing occurs on the default (first-listed) virtual host
  for each addr:port combination, even when not explicitly
  configured. SNI processing does not happen for the subsequent
  virtual hosts with addr:port, defeating the purpose of SNI.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server with           *
  *                  "SSLServerCert" with two arguments          *
  ****************************************************************
  * PROBLEM DESCRIPTION: When "SSLServerCert" has two arguments, *
  *                      the second certificate sometimes isn't  *
  *                      negotiated as expected.                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  "SSLServerCert ecdsa-label rsa-label" is supposed to use the
  certificate labeled "ecdsa-label" if the client supports ECDSA
  authentication and ciphers, otherwise use the 2nd listed
  certificate.
  Due to a programming error, this only worked if the client also
  sent TLS SNI information that matched the SSL enabled virtual
  hosts ServerName or ServerAlias, even if SNI was not actually
  enabled.
  

Problem conclusion

• Two issues were fixed:
  
  1. IHS now chooses from the two listed labels as expected,
  irrespective of an SNI match
  2. Some SNI processing was happening on configurations without
  SNI, leading to unpredictable results. This behavior has been
  removed.
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix packs 9.0.5.14. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels