================================================================================
Sterling Secure Proxy (SSP) APAR IT07778 - Jan 2015 JRE Upgrade - March 2015
================================================================================

This APAR provides the Java Runtime Environment (JRE) only, with instructions 
on how to install it in the Customer's environment. This brings the JRE to the 
Java 1.7 SR8 FP10 fix level from the Oracle Java January 2015 security refresh,
plus the IV70681 APAR fix level, which addresses the recent “FREAK: Factoring 
Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability.

Alternately, the Customer may check the fixlist of the latest iFix cumulative 
maintenance package on Fix Central to see if it includes this level of Java.  
If not, the Customer may contact Support to request that the latest build with
this Java Runtime Environment be placed on the ECuRep server.

===============================================================================
Additional Notes on this Java Runtime Environment (JRE) update
===============================================================================

APAR IT07778 (CM,Engine,PS)  - Upgrade SSP Engine, CM, and PS to IBM JRE 1.7
                               SR8 FP10+IV70681 for latest security patches 
                               which turn off SSLv3 support by default
                     
  With this fix, Sterling Secure Proxy 3.4.2.0 and all versions of Sterling
  External Authentication Server will only allow TLS sessions by default and
  will reject SSLv3 sessions.  Sterling Secure Proxy releases prior to 3.4.2.0
  continue to allow SSLv3 sessions if SSL is coded in the netmap security tab.
  
  If the SSLv3 protocol is required until trading partners can switch to TLS, 
  then for UNIX/Linux, add the
    -Dcom.ibm.jsse2.disableSSLv3=false
  property to the Java startup line(s) in the bin/startEngine.sh script.
  For Windows, add the property to the "lax.nl.java.option.additional="
  line  in the bin\SSPengine$.lax file.


===============================================================================
    IBM Sterling Secure Proxy Instructions for Installing a New JRE
          from IBM Fix Central for the Security Advisory.
===============================================================================

 This process will allow the Customer to pull a new JRE from the IBM Fix Central
 site and replace the existing jre directory in the various installed instances
 of Sterling Secure Proxy (SSP) Engine, SSP Configuration Manager CM, and SSP
 Perimeter Server (PS). The instructions are also valid for the Sterling External
 Authentication Server (SEAS).
 Steps 5 and following must be done for each instance of the SSP Engine, SSP CM,
 SSP PS, and SEAS.

 STEPS 1-3 ARE DONE ONCE AND CAN BE DONE WHILE THE PRODUCT IS RUNNING.

 1. Download the JRE refresh pack archive file from Fix Central to a work
    directory

 2. Extract the JRE refresh pack archive file in the work directory.
      On UNIX:
        cd <work>
        uncompress JRE.tar.Z
        tar -xvf JRE.tar
      Windows: 
        Use WinZip or equivalent to extract from the JRE.zip file.

 3. Verify the version of Java works and is the one expected by the Security
    Advisory:
    
    UNIX:    jre/bin/java -version
    Windows: jre\bin\java -version
    
    See the description at the top of this README file for the version.


 STEPS 4 AND FOLLOWING ARE DONE FOR EACH INSTANCE OF THE SSP ENGINE, SSP CM,
 SSP PERIMETER SERVER and STERLING EXTERNAL AUTHENTICATION SERVER (SEAS).

 4. Make a backup of your target <SSP Installation> directory.

 5. Take the target Sterling Secure Proxy Engine, Configuration Manager, 
    Perimeter Server and/or Sterling External Authentication Server instance
    down

 6. Rename the existing jre directory to jre_old.

 7. Copy the new jre directory from the <work> directory to your
    <SSP Installation> directory

 8. Copy 3 security policy files from the jre_old/lib/security directory
    to the new jre/lib/security directory:

       US_export_policy.jar
       java.security
       local_policy.jar

 9. If SSP3420, copy 2 jar files from the jre_old/lib/ext
    to the new jre/lib/ext directory:

       commons-ssl.jar
       ibmpemkeystore.jar

 10. Start the target Sterling Secure Proxy instance
  
 11. If there are issues starting up the target instance with the new JRE
    a) Save a copy of the bin/startEngine.out file. (startCM.out for the CM)
    b) Rename the jre directory to jre_new, and jre_old to jre, and restart.

 12. Duplicate this process (starting with step 4) for each SSP Engine, CM,
    SSP Perimeter Server, and Sterling External Authentication Server install.