IJ47941: STRICT ENFORCEMENT OF RFC 5246 - TLS 1.2 SECTION 7.4.1.4.1. SIGNATURE ALGORITHMS

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  All certificates in the server's certificate chain are not
  validated to ensure compliance with the client's signature
  extension
  

Local fix

Problem summary

• Many implementations do not follow a strict enforcement of RFC
  5246 - TLS 1.2 Section 7.4.1.4.1. Signature Algorithms. Oracle's
  implementation and therefore, IBM's implementation do not
  validate that the entire server's certificate and its chain are
  in compliance with the signature extension that the client sent.
  Due to the incompatibility nature of such a change and the
  breakage which can ensue, a system property will be added, where
  the user can enable if they want strict compliance. Otherwise,
  the behavior will be unchanged.
  com.ibm.jsse2.strictServerSigCheck = true <PIPE> false
   default - false - do not verify that server's certificate
  chain matches client's signature constraint
   true - validate that server's certificate chain is in
  compliance with client's signature algorithm extension
  

Problem conclusion

• Binary affected - ibmjsseprovider2.jar
  GIT Issue - #281
  RTC - 149627
  Build - 8.0 build_20230815--93
  Build - FIPS140-3 Tech Preview - 8.0 build_20230815--96
  JVM to be delivered in - JDK 8 SR8FP15
  .
  This APAR will be fixed in the following Releases:
  .
  IBM SDK, Java Technology Edition
   8 SR8 FP15 (8.0.8.15)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  maintenance can be found at:
   https://www.ibm.com/support/pages/java-sdk
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels