As HP began to ship its first secure Web server for MPE/iX in late May, the product signalled a beginning to a road of Internet e-commerce services for the platform, not the finish.

Customers can be forgiven for thinking the software was the final piece in the HP 3000 Internet capability. A secure version of a Web server has been on customer wish lists since 1997, when HP first took orders from HP 3000 owners for a secure version of the OpenMarket Web server. OpenMarket dropped out of the Web server market, and an OpenMarket Secure never shipped.

After a one-year interlude with Netscape, HP settled on the Apache/iX open source product, and started shipping it last fall while it continued to hear requests for secure MPE/iX Web services. Last year the HP e3000 division (CSY) wanted to hear business cases to compel it to offer secure Web services native on the HP 3000. This year the company is selling the e3000, repositioning the system as a full player on the Internet.

That Internet commitment is at the heart of the WebWise strategy, one that CSY marketing manager Peggy Ruse said will give HP offerings similar to IBM’s WebSphere and Sun’s iPlanet.

“The decision has not been made on what the second product will be,” Ruse said. “But the idea is to populate the Internet suite with offerings that could include not only HP software, but third party software. And it could include services. Our strategy and philosophy isn’t totally baked yet, but we’re getting there.”

The software that’s fully baked rolled out as the HP WebWise MPE/iX Secure Web Server, priced at $1,290 for Series 918 and 928 systems. Series 929, 939, 968, 969 and 979 systems can run the software for $1,590; all other HP 3000 systems whose model number is higher than a Series 959 pay $1,995. Ruse said the software was priced competitively.

“It’s based on high, medium and low performance,” she said. “It’s a heck of a lot cheaper than OpenMarket, and OpenMarket was not a secure Web server.” A secure Web server available to NT, IBM, Sun and HP-UX servers, Stronghold, sells for $995 for a single license which includes a security certificate. Stronghold is based on Apache 1.3.6, while the new e3000 secure server is based on Apache 1.3.9. The HP server requires an additional purchase of a security certificate which costs between $40 and $200.

Ruse said the OpenMarket customers who purchased the only other HP product for 3000 Web service won’t be getting a trade-in credit to move to the WebWise version of the Apache Secure Web Server.

Encryption capabilities of the WebWise Secure Web Server include SSLv2.0 and v3.0 and TLSv1.0 protocols. The protocols lie between the HTTP and TCP/IP protocol layers and provide secure, authenticated, encrypted communications between the HP WebWise MPE/iX Secure Web Server and browser clients. HP says in its documentation that the security isn’t a substitute for a firewall, or good security practices for hosts, applications and users.

“WebWise is just one component in a secure environment and by itself does nothing to prevent the number one cause of Web server break-in events — poorly written CGI applications,” the documentation stated. “Well-written CGI applications must rigorously validate every byte of data sent by a browser, and must refuse to process any input data containing unexpected characters.”

HP engineer Mark Bixby said that after security, the Secure Server’s next most important feature is Apache Dynamic Shared Object (DSO) support. DSO lets a customer “add on your own functionality to the server in the form of Apache modules loaded from an external NMXL at server initialization time,” Bixby said.

Bixby, who ported the first Apache server to the 3000, said that open source modules like mod_perl or mod_php or mod_jserv are available, “or you could write your own from scratch after reading about the Apache API at www.apache.org. A custom module of your own would provide the tightest integration and greatest performance for interacting with your existing applications.”