PK78007: When an SSL request arrives shortly after an IHS restart, a SSL0600S error is logged

APAR status

• Closed as program error.

Error description

• If a request arrives attempting to re-use a SSL session ID
  right after IHS is restarted, IHS will attempt to connect to
  its external 'sidd' SSL session cache daemon to validate the
  session.  On rare occasions when the request arrives early
  enough after the restart, the external cache daemon may not
  yet be fully initialized.  When this occurs, IHS logs the
  error message:
  'SSL0600S: Unable to connect to session ID cache.'
  
  Other than the message, there are no ill effects since the
  session ID would not be valid after a restart anyway, and in
  each case a new SSL session is established.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: IBM HTTP Server users whose setup leads to   *
  * SSL session re-use attempts shortly after IHS restarts and   *
  * are getting a SSL0600S message logged as a result.           *
  ****************************************************************
  * PROBLEM DESCRIPTION: SSL0600S message getting logged right   *
  * after an IHS restart, due to attempted re-use of an SSL      *
  * session ID.                                                  *
  ****************************************************************
  * RECOMMENDATION: Apply this fix if you are using SSL and are  *
  * getting a single SSL0600S message logged right after an IHS  *
  * restart.                                                     *
  ****************************************************************
  If this message is seen only once, immediately after the server
  has been started, it can be safely ignored, but recommend
  applying this fix.  If the message is seen 1-2 times per SSL
  connection, some other error or misconfiguration is present that
  is not addressed by this APAR.
  

Problem conclusion

• The initialization sequence is altered slightly to provide the
  session cache more time to initialize before requests will try
  to use it.
  
  This fix is targeted for IHS fixpacks:
   - 6.0.2.35
   - 6.1.0.25
   - 7.0.0.5
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R60A PSN

     UP

• R60H PSN

     UP

• R60I PSN

     UP

• R60P PSN

     UP

• R60S PSN

     UP

• R60W PSN

     UP

• R60Z PSN

     UP

• R61A PSN

     UP

• R61H PSN

     UP

• R61I PSN

     UP

• R61P PSN

     UP

• R61S PSN

     UP

• R61W PSN

     UP

• R61Z PSN

     UP

• R700 PSN

     UP