Important iPlanet iWS 4.x Product Alert: Recommend Immediate Upgrade

[iPlanet Web Server Alerts]

iPlanet has identified a potential stability problem in the iPlanet Web
Server (iWS), Enterprise Edition 4.x products. This problem does not
affect any Web Server releases prior to the 4.x versions. A patch to
address it is now available on the iPlanet.com Tech Support site at
<http://www.iplanet.com/support/iws-alert>.

Without this upgrade, the problem can begin without warning and can
affect your sites stability, potentially leading to an outage. iPlanet
believes that this problem is isolated to HTTPS URLS. iPlanet urges all
iWS customers using HTTPS functionality to upgrade immediately to
prevent any potential unnecessary server down time.

[Harish]

Hi,
We have an iWS4.1 Sp3 instance on Solaris box.We are using JDK
1.2.2_05A,Servlet2.2, and JSP 1.1 for .The web Server is taking almost 40 to
50 % of the CPU Resorses.Is this alert related to any performance issues
like this.I couldn't find any detailed explanation of the Problem in iplanet
site.
Any Detailed Explanation of this problem is highly appreciated.Also any
clues to resolve the problem would be a great help for us.

Thanks in Advance
Harish

[Harish]

I forgot to mention that we are also using SSL in my previous note.

Harish

[corinne dive-reclus]

Hello,

I am trying too to set up a SSL server from 4.1SP5 on Solaris but I come up with the following message when I start the server after cretaing a secure database and setting the encryption on:

"Unable to find a certificate or a key for this server in the security database."

But if I look at my alias directory I have got the following files:

secmod.db

https-sun250-sun250-cert7.db

https-sun250-sun250-key3.db

What did I do wrong ?

 I did not have any trouble with that with iPlanet4.1SP3 on WinNt.

Another strange behaviour compared to WinnT: if I use modutil to list all my PKCS11 modules, even if I use -dbdir with the correct path it cannot find https-sun250-sun250-cert7.db and https-sun250-sun250-key3.db. It asked me for cert3.db and key7.db.

 

Thanks for your help.

[Rob Crittenden]

For the first problem, I'm not really sure. This error usually comes
from people requesting the cert (and generating the key) in one instance
and trying to install it in another. If you've requested several certs
you may want to be sure you are installing onto the correct box.

For the second problem, you need to use the -nocertdb option with
modutil. Or if you want to get really tricky, you can make symbolic
links from your cert and key databases to cert7.db and key3.db.

rob

[Joe McCabe]

As I understand it this issue can result in "site stability, potentially
leading to an outage." This would seem to indicate that if your site is
still serving pages then you're not being hit by this issue. Still, the
alert goes on to say that if you're "using HTTPS functionality" at all
then you should upgrade.

Harish wrote:
> We have an iWS4.1 Sp3 instance on Solaris box.We are using JDK
> 1.2.2_05A,Servlet2.2, and JSP 1.1 for .The web Server is taking almost 40 to
> 50 % of the CPU Resorses.Is this alert related to any performance issues
> like this.I couldn't find any detailed explanation of the Problem in iplanet
> site.

--
Joe McCabe Whom computers would destroy they must first drive mad

[VFC]

The download page points to eval copies of iWS. Can we use this version
if we purchased the older versions?

Will IPlanet pls, pls respond?

Thanks,
VFC

iPlanet Web Server Alerts wrote:
>
> iPlanet has identified a potential stability problem in the iPlanet Web
> Server (iWS), Enterprise Edition 4.x products. This problem does not
> affect any Web Server releases prior to the 4.x versions. A patch to
> address it is now available on the iPlanet.com Tech Support site at
> <http://www.iplanet.com/support/iws-alert>.
>
> Without this upgrade, the problem can begin without warning and can

> affect your sites stability, potentially leading to an outage. iPlanet

[viper]

Where is the rest of the announcement? Can we find out exactly what the
problem with site stability is so we can know what to look for? We need to
know how to evaluate whether or not we have the problem, to know whether or
not we need to apply the patch. We are simply not going to apply a patch to
a production system just because someone sends out a notice, especially a
notice without specifics.

We need specifics--now!!

- Tom

[viper]

[viper]

[viper]

[Laurent BLATH]

Hi,
i have download the iWS 4.0SP6 for my aix box (4.3.1)
install it, request a certificate and install it, but when i try to access
my web server with encryption enabled, there is no response and nothing on
logs !
Laurent

iPlanet Web Server Alerts a écrit :

[corinne dive-reclus]

Does that mean I cannot use the HTML interface to create my secure database
and I have to use modutil instead ?
If so, do I have a "console" tool to generate a certificate request and to
install certificate once generated.
Does the HTML management interface work at all on Solaris ?

Thanks for your help

PS: I do not mind at all to use my shell to execute commands, in fact I
would prefer.

"Rob Crittenden" <rc...@greyoak.com> wrote in message
news:3A2EA4AB...@greyoak.com...

[JD]

Laurent -

It is possible that you may have installed the certificate on the adminserver
instead of the webserver. It is possible to have encryption on you admin
server and not your webserver!

After you install the cert, start the server and look at the logs. There may
be a statement related to security not enabled. Ours returned an error that
"the webserver could not be started"....but it did!

Also, your creditials may be different from when you reqeusted the certificate
and when you installed it (ie. domain name, location, etc.)

-JD (Solaris 8, iPlanet 4.1)

[corinne dive-reclus]

[corinne dive-reclus]

[Mike Crist]

Here's a few problems I've noticed with the SP5 release on WinNT 4.0/SP6:

1) Unlike every other Netscape/iPlanet server I've ever worked with, this
one won't let you install over an existing install. Even after removing my
previous install, it still complains that the config directories are still
there and won't complete the install until they are removed. This really
sucks because now I have to reinstall Cold Fusion to update the obj.conf
file. BTW, I tried using the previous obj.conf and magnus.conf files and
the server didn't like that at all.

2) Certain Admin Server functions seem broken. For instance, selecting the
Preferences tab generates a network error (connection reset by peer), yet
all the other tabs work fine. What's up with that?

Any suggestions will be greatly appreciated. Thanks.

Mike Crist
TRW

iPlanet Web Server Alerts wrote:

[jfavier]

Hi,
We have the same config with NT 4/sp6a and IWS 4.1 SP5. But our web server stay
very instable. Have we to remove completely IWS 4.1 sp4 before installing IWS
4.1 SP5.
At this time, the standard behaviour of the SSL server only is : increase of
CPU, increase of memory, increase of network utilization and poor response time.
We have to stop and restart the SSL server. The non-SSL server that is running
on the same machine is working very well with the double of traffic.
Someone has an idea???

Jean-Paul Favier

[Rex Collins]

Jean-Paul,

I'm no expert on this software but logic tells me that the only way to perform
the upgrade correctly is to remove iplanet web server SP4 (leave the Directory
Server alone), upgrade to NTSP6a, and then load iplanet SP5. This is the way I did
it but some of the gurus on here probably have some shortcuts.

jfavier wrote:

--
Rex D. Collins MCP, A+
rcol...@ils-tech.com
System Administrator
ILS Technology
(719) 262-0855 ext 105

[Brandon Johnson]

Hello,

It has been my experience that you have to rename the https-sun250-sun250.cert7 db to cert7.db (and the same with key3.db). If you do this and then use modutil -dbdir . -list from the correct directory, modutil should recognize your pkcs11 module.

[Steve Parkinson]

modutil doesn't actually need to look at your cert/key databases. You can have it turn off the checking by adding this option:

-nocertdb

Steve