IT30601: Performance implications of IT28621 changes

APAR status

• Closed as program error.

Error description

• IT28621 has affected the performance of TLS connections
  
  IT28621 shipped in 9.1.0.3 and 8.0.0.13; the issue will be
  fixed under the original APAR task for 9.0 as the APAR has not
  yet shipped in this release.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  IBM MQ using TLS client and channel connections with versions of
  IBM MQ that include APAR IT28621
  IT28621 shipped in 9.1.0.3, 9.1.0.4 and 8.0.0.13
  
  This issue affects Linux, UNIX and Windows platforms - IBM i is
  not affected due to differences in how data is returned from the
  underlying cryptographic libraries.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  Performance of TLS connections was found to be degraded by a
  GSKit environment setting set by IT28621 that is required to
  fully handle SSL key reset events without the connection
  dropping.
  

Problem conclusion

• The required environment setting must now be enabled by setting
  the AMQ_SSL_USE_IO_EVENTS_HANDSHAKE environment variable. The
  environment variable should be set in the environment used to
  start the queue manager or native client application.
  
  On some slower networks, customers may occasionally experience
  connection drop events coincident with SSL key reset events
  required when using GCM ciphers. If this becomes a problem, then
  the AMQ_SSL_USE_IO_EVENTS_HANDSHAKE environment variable may be
  set to resolve this.
  
  For Windows environments use:
  set AMQ_SSL_USE_IO_EVENTS_HANDSHAKE=1
  
  For Unix environments use:
  export AMQ_SSL_USE_IO_EVENTS_HANDSHAKE=1
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.16
  v9.0 LTS   9.0.0.11
  v9.1 LTS   9.1.0.6
  v9.2 LTS   9.2.0.2
  v9.x CD    9.2.1
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7251

Applicable component levels