VSI-I64VMS-SSL1-V0100-2UA-1-RELNOTES.PDF

This document outlines the release notes for VSI SSL1 V1.0-2UA for OpenVMS Itanium, based on OpenSSL 1.0.2u, released in January 2020.

Key points from the document:

• Co-existence: VSI SSL1 V1.0-2UA is designed to co-exist with VSI SSL 1.4 on the same OpenVMS system.

• Post-Installation Activities: After installation, users must perform several tasks:

  • Ensure SSL1 startup and logical name creation files are executed.
  • Update or copy necessary startup, shutdown, and configuration files from installed templates.
  • Run the Installation Verification Program (IVP).

• Directory Structure: SSL1 establishes a new directory structure, by default under SYS$SYSDEVICE:[VMS$COMMON.SSL1], which differs from the previous SYS$SYSDEVICE:[VMS$COMMON.SSL].

• Startup and Shutdown Procedures:

  • Users need to modify SYS$MANAGER:SYSTARTUP_VMS.COM and SYS$MANAGER:SYSHUTDWN.COM to include SSL1$STARTUP.COM and SSL1$SHUTDOWN.COM respectively.
  • It is crucial that SSL1$STARTUP.COM is invoked after SSL$STARTUP.COM to ensure the "OPENSSL" logical name points to the latest VSI SSL1 1.0 header files.

• Migration of Site-Specific Changes: Any manual changes made to VSI SSL 1.4 configuration files (e.g., startup/shutdown procedures, OpenSSL configuration files like OPENSSL.CNF and OPENSSL-VMS.CNF) must be migrated and applied to the new VSI SSL1 files.

• Certificate Store Migration (CRITICAL):

  • Existing certificate stores from HP SSL V1.4 (or V1.3) must be migrated.
  • The certificate hashing algorithm has changed from MD5 (used in VSI SSL 1.4) to SHA-1 (used in VSI SSL1 V1.0).
  • This change means certificate filenames (which are based on the hash) will be different. Users must manually rename existing certificate files in the store to reflect their new SHA-1 hash values, otherwise, certificate validation will fail.

• Removal: VSI SSL1 can be removed using PRODUCT REMOVE SSL1, though some generated files (e.g., IVP logs, certificates) may remain.