WAS - pmt.sh 沒有任何回應

WAS pmt.sh 執行後無任何反應

ENV:

Centos Stream 9 

WAS v8.5.5.18

Problem:

pmt.sh 執行後無任何反應, 並未如預期起動

Solution:

https://yummy-mint-210.notion.site/WAS-pmt-sh-b780a8dd34844f0aab9a536449ccdc3e?pvs=4

Find out which process is using a port in Linux

1. netstat
# netstat -tuplna|grep port_number
[root@love ~]# netstat -tuplan|grep 1477
tcp        0      0 :::1477                     :::*                        LISTEN      12129/runmqlsr
tcp        0      0 ::ffff:127.0.0.1:1477       ::ffff:127.0.0.1:50240      ESTABLISHED 12710/amqrmppa
tcp        0      0 ::ffff:127.0.0.1:50240      ::ffff:127.0.0.1:1477       ESTABLISHED 23447/java

從上面結果可知:
(1)pid 12129 (runmqlsr)    這個process 在LISTEN 1477這個port
(2)pid 12710 (amqrmppa) 這個process用127.0.0.1的1477 port連往 127.0.0.1的50240 port
(3)pid 23447 (java)           這個process 用127.0.0.1的50240 port連往 127.0.0.1的1477 port


2. fuser
#fuser port_number/tcp -u -v
[root@love ~]# fuser 1477/tcp -u -v
                     USER        PID   ACCESS    COMMAND
1477/tcp:      mqm       12129   F....            (mqm)runmqlsr
                     mqm       12710   F....            (mqm)amqrmppa

3. lsof
#lsof -i :port_number
[root@love ~]# lsof -i :1477
COMMAND  PID  USER FD TYPE DEVICE SIZE/OFF NODE NAME
runmqlsr        12129  mqm   5u  IPv6      699704    0t0       TCP *:ms-sna-server (LISTEN)
amqrmppa     12710  mqm   6u  IPv6     2028669   0t0       TCP localhost:ms-sna-server->localhost:50240 (ESTABLISHED)
java               23447   root  118u  IPv6    2028668   0t0       TCP localhost:50240->localhost:ms-sna-server (ESTABLISHED)

Ref:
Linux Find Out Which Process Is Listening Upon a Port

https://www.cyberciti.biz/faq/what-process-has-open-linux-port/

Custom Properties for improving application startup in WebSphere Application Server

http://www-01.ibm.com/support/docview.wss?uid=swg21983564

Problem(Abstract)

In WebSphere Application Server traditional V9.0, Contexts and Dependency Injection (CDI) 1.2 is enabled by default. Enablement of CDI 1.2 might increase unnecessary performance overhead if the application does not use CDI.

Symptom

The application starts slowly.

Resolving the problem

Disable CDI processing steps for applications or archives that do not contain CDI content, and for which the steps are unnecessary. The following Java custom properties and manifest attributes are introduced to disable CDI processing steps:

Name: com.ibm.ws.cdi.enableImplicitBeanArchives
Allowed Values: true, false
Default Value: true
Description: By setting the com.ibm.ws.cdi.enableImplicitBeanArchives custom property to false, CDI-related annotation scanning steps are disabled for archives that do not contain a bean descriptor, for example, the beans.xml file.

Name: com.ibm.ws.cdi.enableCDI
Allowed Values: true, false
Default Value: true
Description: By setting the com.ibm.ws.cdi.enableCDI custom property to false, all CDI steps are disabled. Set the value to false if no CDI is needed on the server level.

In addition to these Java custom properties that impact all applications that are deployed to the target server, the following properties can be set in the server-wide amm.filter.properties file and as manifest attributes of application archive files.

System Property Name: com.ibm.ws.cdi.enableImplicitBeanArchives
Property and Manifest Attribute Name: Enable-Implicit-Bean-Archive

System Property Name: com.ibm.ws.cdi.enableCDI
Property and Manifest Attribute Name: Enable-CDI

Note:

• The amm.filter.properties file is located at WAS_HOME/properties/amm.filter.properties.
• Manifest attributes are set as main manifest attributes in Java EE-related application archive files, such as EAR, WAR, RAR, and JAR files.
• The Enable-CDI property affects an entire application. Set this property on the Manifest.mf file of the application. Setting this property only for a module archive has no effect.

In this way, the property value from the least enclosing scope is used. An attribute value on a module manifest takes precedence over the attribute value on the application. The attribute value on the application takes precedence over a java custom property value. The java custom property value takes precedence over a property value set in the amm.filter.properties file.

For more information about similar properties, see Reducing annotation searches during application deployment in IBM Knowledge Center.

http://www-01.ibm.com/support/docview.wss?uid=swg21983564

DB2 APAR PI47282 needed when using JAVA SDK8 in WebSphere Application Server V8.5.5.9+

DB2 APAR PI47282 needed when using JAVA SDK8 in WebSphere Application Server V8.5.5.9+
http://www-01.ibm.com/support/docview.wss?uid=swg21982343

PI47282: NEW RELEASE OF THE IBM DB2 DRIVER FOR JDBC AND SQLJ (RELEASE 4.19) PROVIDING VARIOUS ENHANCEHMENT
http://www-01.ibm.com/support/docview.wss?uid=swg1PI47282

SqlException: unsupported encoding Cp037 for result set column
Unsupported ccsid, encoding, or locale: "Cp037". ERRORCODE=-4220, SQLSTATE=22021

WAS may get the following error:
Unsupported ccsid, encoding, or locale: "Cp037". ERRORCODE=-4220, SQLSTATE=22021

如何使用WAS下的scriptLibraries來簡化wsadmin操作

WAS下的scriptLibraries下有一些IBM提供給管理者簡化wsadmin 命令的Library (提供額外的命令來包裝原先複雜的wsadmin 命令), 讓管理可以方便使用。

其使用方法如下﹕(以設定WebContainer thread Pool 為例)

(1)./wsadmin.sh -lang jython -username admin_id -password admin_password

(2)進入wsadmin介面後, 使用execfile來載入擴充的Libraries。
wsadmin>execfile('<WAS-install-root>/scriptLibraries/servers/V70/AdminServerManagement.py')

(3)之後便能使用擴充的指令(至於有哪些指令, 可以自行參考那個.py 檔案的內容說明)
以AdminServerManagement.py 來說其設定Thread Pool的擴充指令為:configureThreadPool
=========================
  Ex40: configureThreadPool
# Example 40: Configure thread pool
def configureThreadPool(nodeName, serverName, parentType, tpName, maxSize, minSize, inactivityTimeout, otherAttrList=[], failonerror=AdminUtilities._BLANK_):

try:

        #--------------------------------------------------------------------

        # Configuring ThreadPool

        #--------------------------------------------------------------------

        print "---------------------------------------------------------------"

        print " AdminServerManagement:  Configuring ThreadPool"

        print " nodeName:               "+nodeName

        print " serverName:             "+serverName

        print " parentType:             "+parentType

        print " threadPoolName:         "+tpName

        print " maximumSize:            %s" % (maxSize)

        print " minimumSize:            %s" % (minSize)

        print " inactivityTimeout:      %s" % (inactivityTimeout)

===========================

(4)依上面說明, 其正確指令可寫成:

wsadmin>

configureThreadPool("loveNode02","base03","ThreadPoolManager","WebContainer","200","100","60000")

(5)其輸出結果如下﹕

---------------------------------------------------------------

 AdminServerManagement:  Configuring ThreadPool

 nodeName:               loveNode02

 serverName:             base03

 parentType:             ThreadPoolManager

 threadPoolName:         WebContainer

 maximumSize:            200

 minimumSize:            100

 inactivityTimeout:      60000

 Optional Attributes:

     otherAttributeList  []

 Usage: AdminServerManagement.configureThreadPool("loveNode02", "base03", "ThreadPoolManager", "WebContainer", "'200'", "'100'", "'60000'")

 Return: If the command is successful, a value of 1 is returned.

---------------------------------------------------------------

[customProperties []]

[inactivityTimeout 60000]

[isGrowable false]

[maximumSize 200]

[minimumSize 100]

[name WebContainer]

1

(6)若要把這二個步驟合成一個, 就自行寫個abc.py, 其內容如下﹕

execfile('<WAS-install-root>/scriptLibraries/servers/V70/AdminServerManagement.py')

configureThreadPool("loveNode02","base03","ThreadPoolManager","WebContainer","200","100","60000")

(7)最後要執行時就只要去指定abc.py 即可:

./wsadmin.sh -f abc.py

http://novicejava1.blogspot.tw/2017/06/configuring-websphere-application.html

http://wsadminlib.blogspot.tw/2010/03/how-to-use-wsadminlibpy.html

https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.multiplatform.doc/ae/cxml_jython.html

How to find out the high CPU thread for WAS on Windows

follow the CPU high mustgather for Windows platform

http://www-01.ibm.com/support/docview.wss?uid=swg21111364

In the threadsout.txt, the Handle column stands for the thread id. You can use this thread id to find out
the java stack in the javacore files.

Install Oracle 11g missing package pdksh-5.2.14 issue

RHEL6 安裝 Oracle 11g 遭遇 pdksh-5.2.14 不存在
http://blog.roodo.com/oraksumi/archives/41081323.html

原因在於 OUI 在進行環境檢查時執行的是下列 command :
----------------------------------------------------------------------------------------
/bin/rpm -q --qf %{version} redhat-release
----------------------------------------------------------------------------------------
在 RHEL6 的環境下 redhat-release 已經被取代為 redhat-release-server-6Server，因此上述 command 會造成了缺少 "elfutils-libelf-devel-0.97" 或是 "pdksh-5.2.14" Package 的錯誤。

解決方式於安裝介質目錄下 database/stage/cvu/cv/admin 找出 cvu_config 這個檔案並且編輯他，將其中的 CV_ASSUME_DISTID=OEL4 改為 CV_ASSUME_DISTID=OEL6 ，如此一來 OUI 便可以正確的檢查系統所需的 Package 了。

由於 "elfutils-libelf-devel-0.97" 或是 "pdksh-5.2.14" 這兩個 Package 並不是必要的，若不想更動 cvu_config 這個檔案，那麼在安裝過程中忽略這個錯誤就可以了。

http://blog.roodo.com/oraksumi/archives/41081323.html

IHS and WAS fix for CVE-2016-2183

For IHS:

IBM HTTP Server and Sweet32: Birthday attack (CVE-2016-2183)

http://www-01.ibm.com/support/docview.wss?uid=swg21991548

For WAS:

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affects WebSphere Application Server January 2017 CPU

http://www-01.ibm.com/support/docview.wss?uid=swg21998379

How to specify the path of the JVM core dump file

https://jazz.net/forum/questions/147686/is-it-possible-to-customize-the-java-core-and-heap-dump-paths-for-tomcat

http://www-01.ibm.com/support/docview.wss?uid=swg21255223

http://www-01.ibm.com/support/docview.wss?uid=swg21242497

Using dump agent to specify the path of the core file

example:

-Xdump:system:file="/path/core.%Y%m%d.%H%M%S.%pid.%seq.dmp"

Recording a response file with Installation Manager

https://www.ibm.com/support/knowledgecenter/en/SSDV2W_1.8.4/com.ibm.silentinstall12.doc/topics/t_silent_create_response_files_IM.html

https://www.youtube.com/watch?v=G7G_uMA17J8

• Windows: IBMIM.exe -record responseFile -skipInstall agentDataLocation
• Linux, UNIX, and the OS X operating system: ./IBMIM -record responseFile -skipInstall agentDataLocation

Example:

Examples:

Table 1. -record commands by operating system

Operating System	Command
Windows	IBMIM.exe -record c:\response_files\install_product.xml -skipInstall c:\skipInstall\IBM_product
Linux, UNIX, and the OS X operating system	./IBMIM -record /response_files/install_product.xml -skipInstall skipInstall/IBM_product

PM85864: SYMBOLIC LINK UNDER INSTALLEDAPPS DIRECTORY DOES NOT GET RETAINED AFTER APPLICATION UNINSTALL AND RE-INSTALL

PM85864: SYMBOLIC LINK UNDER INSTALLEDAPPS DIRECTORY DOES NOT GET RETAINED AFTER APPLICATION UNINSTALL AND RE-INSTALL
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg1PM85864

Any symbolic links that exist in the application installation directory will be deleted when the application is uninstalled or updated.

Problem conclusion

The code has been modified to allow you to set the custom property

com.ibm.websphere.management.application.sync.deleteSymbolicLinks 

on the JVM to false to override the default setting of true.

1) To enable the System Property in the administrative

console: a) In a Network Deployment edition, the system

property needs to be set on the nodeagent. System

administration --> Node agents --> nodeagent --> Java and

Process Management --> Process definition --> Java Virtual

Machine --> Custom properties Name:

com.ibm.websphere.management.application.sync.deleteSymbolicLinks 

Value: true/false

*** both node agent and application server must restart to take effect 

b) In a Base edition, the system property is set on the

server. Servers --> Application Servers --> server1 --> Java

and Process Management --> Process Definition --> Java Virtual

Machine --> Custom Properties Name:

com.ibm.websphere.management.application.sync.deleteSymbolicLinks 

Value: true/false

*** Restrictions: ***

Do not use symbolic links on Microsoft Windows operating systems as they are not supported.

The fix for this APAR is currently targeted for inclusion in

fix pack 8.0.0.7 and fix pack 8.5.5.1.

Bindings and Extensions Conversion Tool

Use of .xmi versus .xml files

1. For pre-JEE5 support you must continue to use .xmi bindings and extensions files
2. For JEE 5 and later you must use .xml bindings and extensions files
3. Approaches for migrating from .xmi to .xml files

      – Done automatically by RAD/RSA when you migrate an app from
        pre-JEE5 to or later.
      – Use the Bindings and Extensions Conversion Tool
•       http://www.ibm.com/developerworks/websphere/downloads/bindings_and_extensions.html

WebSphere Application Server Versions: What’s Different? (Page 145)
http://www-01.ibm.com/support/docview.wss?uid=swg27008724&aid=8

WebSphere Application Server versions to support TLS 1.2

WebSphere Application Server versions to support TLS 1.2

WAS 7.0.0.23 onwards, 8.0.0.3 onwards and 8.5


configuration detail:
https://developer.ibm.com/answers/questions/206952/how-do-i-configure-websphere-application-server-ss.html

已接受的答案

由 ramarika (6236) 回答 | 01月09日 14:26

The following steps works from WAS 7.0.0.23 onwards, 8.0.0.3 onwards and 8.5

System Administrator may also look into backup and restore the configuration before TLSV1.2 configuration as it will affect communication with other programs.

backupConfig command for v8 (contains URL link to restoreConfig command)

http://publib.boulder.ibm.com/infocenter/wasinfo/v8r0/index.jsp?topic=%2Fcom.ibm.websphere.nd.multiplatform.doc%2Finfo%2Fae%2Fae%2Frxml_backupconfig.html&resultof=%22backupConfig%22%20%22backupconfig%22

backupConfig command for v7 (contains URL link to restoreConfig command)

http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.nd.multiplatform.doc%2Finfo%2Fae%2Fae%2Frxml_backupconfig.html&resultof=%22backupConfig%22%20%22backupconfig%22

Modify all WebSphere SSL configurations by running the following manual steps from the WebSphere Application Server console:

a. Log in to the WebSphere Application Server Integrated Solutions Console.

b. Click Security > SSL certificate and key management, and under Related Items, click SSL configurations. ( such as CellDefaultSSLsetting , NodedefaultSSLsetting and any other SSLConfig )

Note: For each node it has their own NodeDefaultSSLsetting and above setting will APPLY BOTH inbound and outbound SSL Communication

d.Select each SSL Configuration described above, then click Quality of protection (QoP) settings under Additional Properties.

e.On the Quality of protection (QoP) settings panel, select TLSv1.2 from the pull-down list in the box named Protocol. change the protocol to TLSV1.2

f.Click Apply and Save.

Update ssl.client.props:

The SSL protocol is set with the com.ibm.ssl.protocol property in the ssl.client.props file. Edit the ssl.client.props file and set the com.ibm.ssl.protocol value to TLS.

For example, modify com.ibm.ssl.protocol=TLSv1.2 This must be done for each ssl.client.props file under the following directories:

For Node example WAS_install\profiles\AppSrv01\properties

For DMGR example WAS_install\profiles\Dmgr01\properties 

Restart the dmgr using stopmanger command and startmanager command

Stop the node: WAS_install\profiles\AppSrv01\bin\stopNode.bat -username -password

Stop all Application Servers running on this node using stopserver command

Note: If neither of these unable to stop properly due to permission issues, or some other issue you will have to manually kill each of these by logging onto the machines and killing the appropriate deployment manager and nodeagent, Application servers processes.

Synchronize the node using syncnode command

  you must run the syncNode.bat or syncNode.sh command from the command line on each federated node, otherwise the nodes will not synchronize in the administrative console. For additional information on the syncNode command,
 
 Windows <was_home>/<profile_home>/bin/syncNode.bat <deploymgr host> <deploymgr soap port>
 
 Unix <was_home>/<profile_home>/bin/syncNode.sh <deploymgr host> <deploymgr soap port>
 
 Note: If you don't know <deploymgr soap port> number you can check from console under system Administration Deployment manager > Ports . Look for SOAP_CONNECTOR_ADDRESS 
 
 Start the node agent on each federated node, and then synchronize nodes in the administrative console.

From WAS_install\profiles\AppSrv01\bin\syncNode.bat dmgrhostname dmgrsoapport -username consoleadminuser -password consoleuserpassword

Start the node: From WAS_install\profiles\AppSrv01\bin\startNode.bat

Check the Sync status of node from console.. and then start the application server from console.

TESTING Methods

USING BROWSER

Testing Configuring browsers to support only TLS 1.2 and access the adminconsole or application.

Restriction: The only browsers that currently support TLSv1.2 are Internet Explorer and Mozilla Firefox.

 1. To configure Internet Explorer version 8 and later, complete these steps:
    a. In Internet Explorer, click Tools > Internet Options.
    b. In the Internet Options dialog box, click the Advanced tab.
    c. Scroll to the Security section, select the Use TLS 1.2 check box, and click OK.

1. To configure Firefox version 24 and later, complete these steps:

   
    a. Open a Firefox browser and enter about:config in the address bar.
       b. When prompted, click I'll be careful, I promise! and accept the warning.
       c. Search for security.tls.version.max.
       d. Double-click security.tls.version.max and change the value to 3 to configure the browser to support TLS1.2.
   
        Tip: Value of 1 supports TLS1.0. Value of 2 supports TLS1.0 and TLS1.1. Value of 3 supports TLS1.0, TLS1.1, and TLS1.2.
   
   
   
   

   USING External Tools such as OPENSSL

You can use openssl s_client connnect to WAS using SSL port like console SSL port or Application server ssl port

openssl s_client -connect webspherehostname:consolesslport -tls1_2

example

openssl s_client -connect webspherehostname:9443 -tls1_2

If it connected to WAS system then it will display the certificate chain in command prompt and the handshake details.. Based on this you will know that WAS system is configured to support TLVs1.2.

Note: The above steps apply for other protocols such TLSV1.1 to SSL_TLSV2

=================================================================================

Frequently asked questions (FAQ) or Questions and Answers (Q&A), are listed as follows

=================================================================================

Question: Is TLS v1.2 supported in WebSphere Full Profile 7.0, 8.0, 8.5? What's minimum fix pack?

Answer: TLsv1.2 Suppport on V7.0.0.23 on wards TLsv1.2 Support on 8.0.0.3 onwards and 8.5.0.0.

Question: Is TLS v1.2 supported in WebSphere Liberty Profile 8.5.5? What's minimum fix pack?

Answer: Liberty can configured with any JDK .. So it is depend what JDK version is configured with Liberty profile. If you are using IBM JDK v1.6 jdk SR11 then it is supported. if you are using below version of this JDK then it is not supported

TLSv1.2 is introduced on JDK 1.6 Sr10 . which mean it starts from WAS7.0.0.23 ( JDK1.6 SR10 FP1)) onwards

see the following link

JSSE enhancements The following enhancements were made in the JSSE in IBM SDK for Java™ V6 service refresh 10:

  The IBMJSSE2 provider now supports Transport Layer Security (TLS) 1.1 as described in RFC 4346. The most important update is protection against cipher block chaining (CBC) attacks.
  **The IBMJSSE2 provider now supports TLS 1.2 as described in RFC 5246. Among other things, this RFC specifies different internal hashing algorithms, adds new cipher suites, and contains improved flexibility, particularly for negotiation of cryptographic algorithms**.

Service refresh 10

https://www.ibm.com/support/knowledgecenter/SSYKE2_6.0.0/com.ibm.java.security.component.60.doc/security-component/whats_new/security_changes_60/security_whatsnew_sr10.html

Question: Which cipher suites supports with TLSv1.2 protocol?

Answer: Cipher suites with SHA384 and SHA256 are available only for TLS 1.2 or later more details Please see the following link

Cipher suites

https://www.ibm.com/support/knowledgecenter/SSYKE2_6.0.0/com.ibm.java.security.component.60.doc/security-component/jsse2Docs/ciphersuites.html

Cipher suites

https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/ciphersuites.html

Question: Do I have to enable FIPS strict mode in order to use TLSv1.2?

Answer: No. You can configure WAS to use TLSv1.2 without FIPS.

Question: WAS is act SSL client, Does Remote SSL server has to use TLSV1.2 as well, in order to work?

Answer: Yes BOTH Client side and Server side MUST use TLSv1.2 for SSL communication.

Question: WAS is act SSL client, What does remote SSL server support only TLSv1.0 or TLSv1.1 and Similar WAS is act SSL Server, What does Remote SSL client does support only TLSv1.0 or TLSv1.1 or TLSv1.2. What to do in order to work such environments?

Answer: There is an alternative option, SSL_TLSv2, which will enable support for TLSv1.0, TLSv1.1, and TLSv1.2 in the environment. Please use this setting SSL_TLSv2 in environments where support for multiple TLS protocols is required, or if you are not sure whether your WAS environment interacts with other servers or clients using non-TLSv1.2 protocols then, you can configure WAS to use SSL_TLSv2 using same steps as given in the above.

Note:

Without poddle fix and configured WAS to use SSL_TLSv2

SSL_TLSv2 ==> Enables all SSL v3.0 and TLS v1.0, v1.1 and v1.2 protocols. Accepts SSLv3 or TLSv1 hello encapsulated in an SSLv2 format hello.

If you installed Poddle fix (will disable SSLv3 ) and configured WAS to use SSL_TLSv2

SSL_TLSv2 ==> Enables these three TLS v1.0, v1.1 and v1.2 protocols.

Question: Why do I receive a GSK_ERROR_SOCKET_CLOSED (gsk rc = 420) error, when WebSphere Application Server and IBM HTTP Server are configured to use TLSv1.2?

Answer: you need to have StrictSecurity="true" in the plugin-cfg.xml for TLSv1.2 to work. More details see the following link

https://developer.ibm.com/answers/questions/249099/why-do-i-receive-a-gsk-error-socket-closed-gsk-rc.html

Best Regards

Ram

10055-sslclientprop.jpg (109.6 kB)

6100-celldefaultssl.jpg (39.7 kB)

6102-xdssl.jpg (28.0 kB)

6101-nodessl.jpg (32.5 kB)

   11   分享

由 Steve Reid (1825) 回答 | 2015年12月02日 15:24

Please note that IBM HTTP Server (IHS) v7.0, and IBM web server Plug-in v7.0, do NOT support TLSv1.1 or TLSv1.2. So, enabling TLSv1.2 in WAS may cause a failure if you are using v7.0 web server Plug-in.

For TLSv1.2 support in IHS and Plug-in, you need to upgrade to v8.x. Please see the following page:

THE PLUG-IN DOES NOT CONNECT TO THE APPLICATION SERVER IF THE APPLICATION SERVER IS SET TO USE TLS1.1 OR 1.2.

   4   分享

由 ramarika (6236) 回答 | 2016年11月08日 10:31

How do I change my WebSphere SSL configuration to use protocol TLsv1.2 in a standalone Websphere Application server where you have servername called server1. Please see the following youtube link.

The above manual steps for ND environment where you have dmgr, nodeagents and application server.

https://www.youtube.com/watch?v=SdsB71u7Ckw

Best Regards

Ram Arika

   2   分享

由 Naveen_Shetty (746) 回答 | 2016年09月19日 09:41

Alternately on the IHS side

Here is how to disable all protocols accept TLS1.2 in your IBM http server.

Add the following lines in the VirtualHost stanza for your SSL configuration. (For each VH:SSL port configured).

SSLProtocolEnable TLSv12 SSLProtocolDisable SSLv2 SSLv3 TLSv10 TLSv11

Now if I wanted to allow only a specific Cipher within TLS 1.2 (example is below), I would add SSLCIpherSpec directive as a 3rd line. SSLCipherSpec TLSv12 TLS_RSA_WITH_AES_256_CBC_SHA256

To verify what is allowed, one can use the following command in IBM http server

/opt/ibm/HTTPServer/bin/apachectl -DDUMP_SSL_CONFIG

Optionally, a debug level IS errorlog would give you the same information during startup. startup.

NOTE: Any change to the IHS httpd.conf file needs a server restart for it to take effect.