PM38866: PLUGIN DOES NOT RETRIEVE CLIENT CERT DATA FROM APACHE HTTP SERVER CORRECTLY

Fixes are available

APAR status

Closed as program error.

Error description

The client is receiving an "invalidCertificateChain" error when
their application attempts to call the
"java.security.cert.X509Certificate certChain [] =
(java.security.cert.X509Certificate
[])req.getAttribute?("javax.net.ssl.peer_certificates");" method
from within their WebSphere Application Server application.
This method programmatically retrieves the client cert through
the $WSCC header parameter from the WebSphere Application
Server plugin.  It is the responsibility of the plugin to
retrieve the client cert info from the HTTP Server environment
variables that are set by the HTTP Server during the initial
SSL handshake with the client.  In the client's case, the
client cert is being returned as a NULL value on the
getAttribute call.

WebSphere Application Server plugin was retrieving the client
cert data using EBCDIC literal keys from tables that use
ASCII keys.  This resulted in the data not being retrieved
correctly by the plugin.

Local fix

Use the WAS v6.1 plugin or access the application directly
through the WCS_defaulthost_secure transport.

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server version 6.1, 7.0 and 8.0 running on  *
*                  i5/OS.                                      *
****************************************************************
* PROBLEM DESCRIPTION: An error is observed when an            *
*                      application ties to retrieve            *
*                      certain attributes of the client's      *
*                      certificate.                            *
****************************************************************
* RECOMMENDATION:  Apply the 6.1.0.41, 7.0.0.19 or 8.0.0.1     *
*                  fix pack.                                   *
****************************************************************
When an application tries to retrieve certain attributes of the
Client's certificate, eg : "javax.net.ssl.peer_certificates",
it gets a NULL value instead of a valid certificate or
certificates.

Problem conclusion

The plugin has been modified to retrieve SSL values related to
Client Certificates properly.

The fix for this APAR is currently targeted for inclusion in
6.1.0.41, 7.0.0.19 and 8.0.0.1 fix packs.  Please refer
to the Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

```
NA
```

Comments

APAR Information

APAR number
PM38866
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2011-05-10
Closed date
2011-06-29
Last modified date
2011-06-29

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R61W PSY
UP
R700 PSY
UP
R800 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
27 October 2021

Tips

PM38866: PLUGIN DOES NOT RETRIEVE CLIENT CERT DATA FROM APACHE HTTP SERVER CORRECTLY

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R61W PSY

R700 PSY

R800 PSY

Document Information

Share your feedback

Need support?