IJ07129: DIFFERENCES IN PKCS12 ALIAS TREATMENT BETWEEN IBM AND ORACLE

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  Output from the command "openssl pkcs12 -info -in
  CAMKeystore.new"
  You should see the following... search for "friendlyName:
  encryption" string... you will see 3 entries: 1 for the private
  key, 1 for the server certificate, and 1 for the CA certificate
  with the IBM keystore (that is the problem reported here). With
  the Oracle JRE, you will only find 2 entries: 1 for the private
  key and 1 for the server certificate... the CA certificate has a
  different "friendlyName".
  

Local fix

• N/A
  

Problem summary

• In certain cases, when a PKCS12 keystore is read, an additional
  CertBag is created to contain the CA cert. In this CertBag, the
  attribute info for Oracle-converted versions of the file
  contains the DN rather than an alias which matches the
  associated entries.
  

Problem conclusion

• The code for java 8 was updated to match closer to what Sun
  does. This way the KeyStores in the is case match Sun's, but
  still support the necessary migration from the other IBM JVM's
  PKCS12 keystore types.
  Austin APAR is IJ05778
  Austin CMVC defect 117851 and level 20180424
  RTC 137899
  Verified in build 20180614_03 for Java 8
  This is will be part of 80SR5FP20
  .
  This APAR will be fixed in the following Java Releases:
   8 SR5 FP20 (8.0.5.20)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels