The Web Server Landscape: Where IBM HTTP Server Fits In
For "z/OS and Friends," Dr. Joe Gulla looks at the special role played by the IBM product, how it works with WebSphere Application Server and how other web servers compare
In my previous “Z/OS and Friends” article, I covered WebSphere Application Server (WAS), but WAS doesn’t interact with web browser clients on its own. That’s the job of IBM HTTP Server (IHS), which occupies a special role in z/OS as IBM’s custom-made front-end to WebSphere Application Server (WAS).
In this article, I will discuss how is it used and by whom. And because IHS is limited to the WAS, context I will also survey the other web servers in the industry, including both open-source and proprietary/enterprise web servers. I will go on to address which web servers are “at home” on z/OS and finish with a discussion of containerization, which follows an explanation of the Web Servers that make use of z/OS Container Extensions.
What Is IHS?
IHS is an IBM implementation based on the Apache HTTP Server. It is a high-performance web server used to handle HTTP requests from web-browser clients and pass them to WAS. It was tailored by IBM to play a special role, so it is only supported when used in a WAS configuration along with the WAS Plugin. IBM provides the Web Server Plug-ins Configuration Tool to help install and configure the plugin. The tool creates a configuration file and sets up the web server to forward requests to WAS.
While based on Apache HTTPd server, IHS is not an exact copy of Apache HTTPd and doesn’t include all Apache modules and features. However, IHS runs on the same platforms as WAS, including AIX, Linux, Windows, Solaris, HP-UX and z/OS making use of Unix System Services (USS).
How Is it Used?
IHS has several roles as a front-end to WAS. The section below discusses IHS in four functional categories:
1. Works as a Reverse Proxy
IHS often acts as a reverse proxy in front of WAS. It receives incoming HTTP requests and forwards them to the appropriate WAS instance. This setup hides internal server details from clients, enables load balancing and routing and improves security by isolating the application server.
2. Supports SSL Termination, Security and Access Control
IHS can handle SSL/TLS encryption, terminating secure connections before passing requests to WAS. This offloads cryptographic processing from the application server and centralizes certificate management. IHS can enforce access control policies, authentication, and IP filtering before requests reach WAS. To do this, IHS uses Apache-based directives and modules to enforce access control. These directives define access rules for specific paths or resources.
IHS also supports multiple authentication mechanisms including basic and digest authentication, LDAP authentication, client certificate authentication and single sign-on. All these mechanisms add extra layers of protection.
3. Request Filtering and URL Mapping
IHS can filter requests based on rules and redirect or rewrite URLs. It can also serve static content directly, including .html, .css, .js, .jpg, .png, .ico and other content. Doing so reduces the process load on WAS. Table 1 contains reference to the modules used to implement these features.
Table 1. Summary of Selected Features
| Feature | Purpose | Module Used |
| Request Filtering | Block or allow based on IP address, headers or methods | mod_authz_core mod_setenvif |
| URL Rewrite/Redirect | Dynamically modify or redirect URLs | mod_rewrite mod_alias |
| Static Content | Serve files directly bypassing need to invoke WAS | Basic Apachefunction plus plugin-cfg.xml tuning |
4. Provides Load Balancing
When multiple WAS instances are deployed, for example, in a cluster implementation, IHS can distribute traffic among them using the plugin. The implementation supports high availability and scalability.
The main roles of IHS are summarized in the figure below:
Who Uses It?
IBM HTTP Server is used across a wide range of sectors including finance, manufacturing, banking business services and insurance. It is used by large enterprises running WAS and other IBM middleware. Also, government and financial institutions that rely on IBM z/OS or AIX. Additionally, it is used by organizations with strict compliance/security needs, leveraging IBM’s support and integration.
What ‘Space’ Does IHS Occupy?
IHS sits in the enterprise-grade web server space, particularly middleware integration, security and compliance, and platform versatility as shown in Table 2.
Table 2. Summary of IHS and Its role
| Role | Description |
| Middleware integration | Tightly coupled with WebSphere and IBM Cloud offerings |
| Security and compliance | Supports Federal Information Processing Standards, Transport Layer Security, Lightweight Directory Access Protocol and RACF integration |
| Platform flexibility | Runs on AIX, Linux, Windows, Solaris, HP-UX and z/OS |
It’s not typically used for general-purpose web hosting like Apache or Nginx, but rather in mission-critical, high-security enterprise environments that require a rich application server like WAS.
What Other Web Servers Are in This Category?
Let’s start with a focus on enterprise/proprietary servers. You will read that there is often a relationship between application servers and their supporting HTTP server not unlike the relationship between IHS and WAS.
Enterprise/Proprietary Web Servers
Here is a discussion of six web servers including Microsoft Internet Information Services, Oracle WebLogic/Oracle HTTP Server, Red Hat JBoss/WildFly, Sun Java System Web Server, SAP Web Dispatcher and LiteSpeed Enterprise.
Microsoft Internet Information Services (IIS) is a flexible, secure and scalable web server built into Windows Server. It supports multiple protocols including HTTP, HTTPS, FTP and SMTP and integrates tightly with ASP.NET and other Microsoft technologies. IIS is widely used in enterprise environments for hosting websites, web applications and services. It offers features like application pools and load balancing, with strong security controls.
Oracle WebLogic Server is a powerful Java EE application server used for deploying enterprise-grade applications. It supports high availability, clustering and integration with Oracle’s middleware stack. Oracle HTTP Server (OHS), based on Apache, acts as a front-end web server that can proxy requests to WebLogic. Like the relationship between IBM IHS and WAS, OHS offers SSL, URL filtering and load balancing capabilities to Oracle WebLogic Server.
WildFly (formerly JBoss AS) is a lightweight, modular, open-source Java application server developed by Red Hat. It supports Jakarta EE and MicroProfile standards, offering fast startup, efficient memory usage and flexible management tools. WildFly serves as the upstream project for Red Hat’s commercial JBoss EAP. This makes it ideal for developers and enterprises seeking open-source Java solutions.
Sun Java System Web Server, originally developed by Sun Microsystems (now Oracle), is known for its high performance, scalability and support for Java technologies like Servlets and JSP. It’s designed for enterprise use, offering multi-threaded processing, virtual server management and integration with SNMP for monitoring. Sun Java System Web Server remains in use in some specialized environments.
SAP Web Dispatcher is a reverse proxy and load balancer that sits between the internet and SAP systems. It routes HTTP(S) requests to appropriate SAP application servers, enhances security by filtering traffic and supports load balancing across multiple instances. It’s vital for SAP landscapes requiring secure and efficient web access.
LiteSpeed Enterprise is a high-performance, event-driven web server designed as a drop-in replacement for Apache. It supports HTTP/3, built-in caching using LSCache, ModSecurity and asynchronous SSL handshakes. Known for its speed and efficiency, LiteSpeed is popular among hosting providers and high-traffic websites, especially those using WordPress or other CMS platforms.
Table 3. Summary of Enterprise/Proprietary Web Servers
| Web Server | Details |
| Microsoft IIS | Integrated with Windows Server. Strong in .NET environments NET and Windows Server apps. |
| Oracle WebLogic with Oracle HTTP Server (OHS) | Enterprise-grade Java server. Oracle Fusion Middleware. Competes with WAS. |
| Red Hat JBoss/WildFly | Open-source Java EE server. Considered a WAS alternative. |
| Sun Java System Web Server | A legacy server that offers high performance, scalability and support for Java technologies. |
| SAP Web Dispatcher | SAP application front-end. Provides vital security and efficiency. |
| LiteSpeed Enterprise | LiteSpeed Tech product offering high-performance hosting, especially for CMS platforms. |
Open-Source Web Servers
Here is a summary of the research on open-source servers. This discussion includes seven servers including Apache HTTP Server, NGINX, Caddy, OpenResty, Tomcat, Lighttpd and Cherokee.
Apache HTTP Server is one of the most widely used open-source web servers, known for its flexibility, modular architecture and strong community support. It supports dynamic content through modules like PHP and Python and is a core component of the LAMP stack. Apache excels in compatibility and configurability, making it a popular choice for hosting everything from personal blogs to enterprise applications.
NGINX is a high-performance, event-driven web server and reverse proxy known for its ability to handle thousands of concurrent connections with minimal resource usage. Originally designed to solve the C10k problem, it’s widely used for load balancing, caching, and serving static content. NGINX is favored by high-traffic websites and modern cloud-native architectures.
Caddy is a modern, open-source web server written in Go, distinguished by its automatic HTTPS configuration using Let’s Encrypt. It offers a simple configuration syntax, built-in support for reverse proxying, and a REST API for dynamic configuration. Caddy is useful for developers seeking secure, scalable and easy-to-deploy web services.
OpenResty is a dynamic web platform built on NGINX and LuaJIT, enabling developers to write high-performance web applications directly within the web server. It supports non-blocking I/O with databases and backend services, making it ideal for scalable APIs, gateways and real-time applications. OpenResty is widely used in high-concurrency environments.
Apache Tomcat is an open-source Java servlet container and web server developed by the Apache Software Foundation. It supports Java Servlets, JSP and WebSocket technologies, making it a popular choice for hosting Java-based web applications. Tomcat is lightweight, reliable and widely adopted in enterprise environments.
Lighttpd is a lightweight, open-source web server optimized for speed and low resource consumption. It uses an event-driven architecture to handle thousands of concurrent connections efficiently. Lighttpd is ideal for serving static content and is often used in embedded systems and high-performance environments.
Cherokee is a flexible, high-performance open-source web server with a user-friendly web-based administration interface. It supports modern web technologies like FastCGI, SCGI, TLS/SSL and reverse proxying. Cherokee is designed for ease of configuration and is used in embedded devices and IoT applications due to its lightweight footprint.
Table 4. Summary of Open-Source Web Servers
| Web Server | Details |
| Apache HTTP Server | Most widely used globally. Modular, highly configurable. Strong community support. Basis for IHS itself. |
| NGINX | High-performance, event-driven architecture. Excellent for reverse proxy, load balancing, and static content. Powers many high-traffic sites. |
| Caddy | Automatic HTTPS, simple configuration. Ideal for small to medium sites. |
| OpenResty | Built on NGINX, supports Lua scripting. Great for microservices and APIs. |
| Tomcat | Java-based servlet container. Ideal for Java EE applications. |
| Lighttpd | Lightweight and fast open-source software. |
| Cherokee | Open-source software that utilizes a GUI-based config. |
Which Web Servers, Frameworks and Services Are “At Home” on z/OS?
Here are four examples of servers that run on z/OS:
IHS
As has been discussed earlier in this article, IHS is fully supported and includes RACF integration. IHS requires z/OS USS to run because it is a process that runs within the USS environment on the z/OS operating system. IHS is essentially the Apache web server ported to z/OS that is installed and configured. IHS relies on the POSIX-compliant USS subsystem for its operation, including the ability to create and run processes with user IDs.
z/OSMF HTTP Server
The z/OSMF HTTP Server is the underlying mechanism that enables the web-based user interface and REST services of the IBM z/OS Management Facility (z/OSMF). As a core component of z/OSMF, it facilitates communication between client applications, like web browsers, and the z/OS system. Here is an overview of z/OSMF if you are not familiar with it.
Zowe
Zowe is a collection of components that together form a framework that makes Z-based functionality accessible across an organization. Zowe capabilities include exposing Z-based components, such as z/OSMF, as REST APIs. The Zowe framework provides an environment where other components can be included and exposed to a broader non-Z-based audience. The Zowe API Gateway is built on Node.js/Nginx and is targeted for modern z/OS APIs.
The framework focus is API support, not web serving as such. Zowe is an open-source project within the Open Mainframe Project that is part of The Linux Foundation.
IBM CICS Web Support
CICS web support is a collection of CICS services that enable a CICS region to act both as an HTTP server and an HTTP client. This function is useful because it enables CICS applications to interact with web-based clients and services.
What About Other Web Servers on Unix System Services on z/OS?
z/OS UNIX System Services provides a POSIX-compliant environment that supports several web servers. HCL Domino (formerly Lotus Domino) is still in use, but older versions are obsolete and nearing end of support. Newer versions of Domino are still actively developed and supported by HCL Technologies. Many large organizations continue to use it for its strengths in application development and security, and as a complete package.
What About Web Servers on Linux on z/OS?
Linux on z/OS is typically deployed using z/OS Container Extensions (zCX), which allows Linux containers to run natively on z/OS. Common Linux Web Servers supported in zCX include Apache HTTP Server, NGINX, Lighttpd, Node.js-based servers and Tomcat (for Java-based web applications). These are standard Linux packages and can be installed in zCX containers just like on any other Linux environment.
What About Web Servers on Linux on IBM Z?
Linux on System z or LinuxONE supports mainstream Linux distributions including Red Hat Enterprise Linux (RHEL) for IBM Z, SUSE Linux Enterprise Server (SLES) for IBM Z and Ubuntu Server for IBM Z. These distributions support all major open-source web servers including Apache HTTP Server (httpd), NGINX, Tomcat, Node.js, Lighttpd, Caddy, Gunicorn (for Python apps) and uWSGI.
These servers can be deployed natively on LPARs, in virtual machines under z/VM and in containers using Docker or Red Hat OpenShift on IBM Z. Containerization has had a significant impact on how web servers are deployed, managed and scaled—especially in cloud-native and hybrid cloud environments.
What Are the Key Effects of Containerization?
Consider these six main items as effects of containerization, thinking of them simply as benefits of the invention.
1. Simplified Deployment
Web servers like Apache HTTP Server, NGINX, IHS and others can be packaged into containers—for example, Docker images—making them portable across environments including development, test and production. These containers are consistent in configuration and dependencies and quick to deploy with minimal setup.
2. Scalability and Orchestration
With container orchestration platforms like Kubernetes or OpenShift, web servers can be scaled horizontally. Basically, this means more instances created and used during peak traffic. The instances can be automatically restarted if they fail and load-balanced across multiple containers. This is especially useful for cloud-native architectures where elasticity and resilience are key.
3. Isolation and Security
Each container runs in its own isolated environment, which reduces the risk of conflicts between applications, enhances security by limiting the impact of vulnerabilities and allows for fine-grained access control and resource limits.
4. Faster Continuous Integration/Continuous Deployment Integration
Web servers in containers can be more easily integrated into continuous integration/continuous deployment (CI/CD) pipelines. They can be automatically tested and deployed with infrastructure-as-code tools and version-controlled and rolled back if needed.
5. Hybrid Cloud Compatibility
Containerized web servers can run on-premises, for example, on z/OS via zCX or Linux on Z. They can be run in public clouds like AWS, Azure and IBM Cloud, and in hybrid environments with consistent tooling and monitoring. This makes them ideal for hybrid cloud strategies, where workloads span multiple environments.
6. Lightweight Alternatives
Containerization has encouraged the use of lightweight web servers like Caddy, Lighttpd and Traefik. These are often used in microservice architectures where each service might have its own embedded web server.
A Complex, Fast-Moving Industry
The web server/application server industry is complex. It is interwoven with technologies, both old and new, and is subjects to frequent change. There are proprietary and open-source models. And there are many operating systems and platforms to support. Despite this complexity, web servers like IHS have carved out a place where they perform well and meet the needs of customers.
It is common to see a pairing of web and application server that provides many familiar benefits. These pairings often perform well in a variety of circumstances depending on the focus like high availability or security or both. Other factors, including start-up speed, use of an administrative GUI or the size of the site being supported, can be important considerations. There is a web server for every need, and new ones are developed when the paradigm shift merits it.
What Is Next?
My next article will be a deep dive into programming language support on z/OS and System Z. The initial focus will be on traditional enterprise languages, modern and open-source languages, and scripting and automation tools.