PM72915: TLS compression should be disabled by default in IHS

Download Description

PM72915 resolves the following problem:

ERROR DESCRIPTION:
TLS Compression is enabled by default in V8R0 and later, but there is no integration with commonly used compression at the HTTP level.

USERS AFFECTED:
Users of IBM HTTP Server (IHS) V8R0 and later with SSL enabled on distributed platforms. z/OS is not affected.

PROBLEM DESCRIPTION:
TLS Compression was added to GSKit version 8, but there is no
reason to enable this support in IBM HTTP Server which already
has application layer compression support.
The different layers of compression are not aware of each other
and cause unnecessary CPU.

RECOMMENDATION:
Apply this fix if using SSL with IBM HTTP Server.

CIRCUMVENTION:
To disable TLS compression in IHS levels prior to those including PM72915,
set the following directive everywhere you set the 'SSLEnable' directive:

SSLAttributeSet 445 1

PROBLEM CONCLUSION:
IHS was updated to properly disable TLS Compression by default.
TLS Compression can be re-enabled by setting the 'SSLCompression'
directive to 'ON'.

This fix is targeted for IHS fixpacks:
- 8.0.0.5
- 8.5.0.1