PH55900: UPGRADE IBM LDAP SDK TO ENABLE TLSV13

APAR status

• Closed as new function.

Error description

• Upgrade IBM LDAP SDK to enable TLSv13
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server with LDAP      *
  *                  authentication/authorization                *
  ****************************************************************
  * PROBLEM DESCRIPTION: Outbound LDAP connections cannot use    *
  *                      TLSv13                                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The embedded IBM LDAP SDK does not support TLSv13, and there is
  no configuration mechanism to choose the TLS protocol.
  

Problem conclusion

• The embedded LDAP SDK was updated to 10.0.1 on Linux (all but
  PPC big-endian) Windows, and AIX. The LDAPSSLProtocol directive
  was added to control the list of enabled protocols, defaulting
  to "TLS12,TLS13" on the updated platforms.
  
  There is no change to zOS where LDAP TLS configuration must be
  done with zOS LDAP and System SSL environment variables.
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix pack 9.0.5.17. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels