PM68915: SSL connection failure after upgrading to 7.0.0.23, 8.0.0.3 and 8.5.0.0 due to Elliptical Curve Cryptography (ECC) suites.

Fixes are available

APAR status

Closed as program error.

Error description

SSL connection failure may happen after upgrading to 7.0.0.23,
8.0.0.3 and 8.5.0.0 between WebSphere and any peer program.
This is caused by WebSphere including ECC ciphers in default
cipher suites and using it for SSL handshake. This APAR
removes the ECC ciphers from WebSphere's default ciphers.

For example, if WebSphere Application Server is configured to
use LDAP via SSL and the LDAP does not support ECC
certificates, dmgr and  appserver would fail to start with the
following error. LDAP authentication error :
[21/06/12 17:19:32:197 BST] 00000014 exception     E
com.ibm.ws.wim.adapter.ldap.LdapConnection getDirContext

com.ibm.websphere.wim.exception.
WIMSystemException: CWWIM4520E  The 'javax.naming.
CommunicationException: simple bind failed:
oiduat.company.com:4030
[Root exception is javax.net.ssl.SSLException: Received fatal
alert: illegal_parameter]' naming exception occurred during
processing.

Other errors related to this APAR include:
[8/21/12 12:41:15:979 EDT] 00000022 SystemOut     O
WebContainer : 1,  fatal error: 80: problem unwrapping net
record javax.net.ssl.SSLHandshakeException: No supported
signature algorithms in common

[8/21/12 12:40:17:308 EDT] 00000021 SystemOut     O Extension
elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1}

Also in JSSE or WebSphere trace, ECC ciphers (ciphers starting
"SSL_ECDH" or "TLS_ECDH") are printed.

Local fix

```
n/a
```

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server                                      *
****************************************************************
* PROBLEM DESCRIPTION: SSL connection fails due to             *
*                      Elliptical Curve Cryptography           *
*                      (ECC) ciphers are set on socket.        *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
If WebSphere Application Server runs on one of following IBM
SDK 6.0 SR10, 6.26 SR1 or 7.0 SR1, which is available with
WebSphere 7.0.0.23, 8.0.0.3 and 8.5.0.0 as SDK update,
the Application Server includes ECC ciphers in its cipher
suites and sets on its sockets. If peer programs that
communicate with WebSphere do not support ECC ciphers,  this
causes SSL connection failure.

Problem conclusion

Code has been updated to remove the ECC ciphers from default
cipher suite.  ECC ciphers are available and still set on
socket if
- New FIPS standards (SP800-131a strict or Suite B) is enabled
or
- the following custom property is set at security top level
com.ibm.websphere.ssl.include.ECCiphers to true

The fix for this APAR is currently targeted for inclusion in
fix pack 7.0.0.25, 8.0.0.5 and 8.5.0.1.  Please refer to the
Recommended Updates
page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PM68915
Reported component name
WEBSPHERE APP S
Reported component ID
5724J0800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2012-07-16
Closed date
2012-08-14
Last modified date
2013-03-20

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

PM70522

Fix information

Fixed component name
WEBSPHERE APP S
Fixed component ID
5724J0800

Applicable component levels

R700 PSY
UP
R800 PSY
UP
R850 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 October 2021

Tips

PM68915: SSL connection failure after upgrading to 7.0.0.23, 8.0.0.3 and 8.5.0.0 due to Elliptical Curve Cryptography (ECC) suites.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

R800 PSY

R850 PSY

Document Information

Share your feedback

Need support?