IJ03552: IBMPKCS11IMPL CONFIG FILE PROBLEM WITH THE SLOT SPECIFICATION ATTRIBUTE

APAR status

• Closed as program error.

Error description

• Error Message: Depends on the slot that is actually hit (either
  a wrong slot, or the slot did not exist).
  .
  Stack Trace: Exception in thread "main"
  java.lang.ExceptionInInitializerError
   at java.lang.J9VMInternals.ensureError(J9VMInternals.java:141)
   at
  java.lang.J9VMInternals.recordInitializationFailure(J9VMInternal
  s.java:130)
  
  Caused by: java.lang.RuntimeException: java.io.IOException:
  com.ibm.pkcs11.PKCS11Exception: Pin is incorrect
   at PKCS11J8_s1.<clinit>(PKCS11J8_s1.java:19)
  Caused by: java.io.IOException: com.ibm.pkcs11.PKCS11Exception:
  Pin is incorrect
  com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl.Init(IBMPKCS11I
  mpl.java:1156)
   at PKCS11J8_s1.<clinit>(PKCS11J8_s1.java:13)
  Caused by: com.ibm.pkcs11.PKCS11Exception: Pin is incorrect
   at com.ibm.pkcs11.nat.NativePKCS11Session.login(Native Method)
   at
  com.ibm.crypto.pkcs11impl.provider.Session.login(Session.java:13
  0)
   at
  com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl.Init(IBMPKCS11I
  mpl.java:1148)
   ... 1 more
  .
  N/A
  

Local fix

Problem summary

• IBMPKCS11Impl config file problem with the slot specification
  attribute
  

Problem conclusion

• he code has been updated to preserve the slot number based on
  where the customer placed the token. This is different that the
  current method which basically collapses the list to just the
  tokens installed and reports the slot number based on that list.
  This change needed to be made in a compatible way to how it
  works today. Therefore, a new system property was created called
  "com.ibm.pkcs11.compat" was created. When this is set to "false"
  the new behavior will be seen.
  This update was done in JVMs 60, 626, 70 727 and 80
  The Austin CMVC defect is 117790
  Build Level is 20180110
  Changes were made to ibmpkcs11impl.jar
  Austin APAR is IJ00441
  .
  This APAR will be fixed in the following Java Releases:
     8    SR5 FP10  (8.0.5.10)
     7    SR10 FP20 (7.0.10.20)
     6 R1 SR8 FP60  (6.1.8.60)
     6    SR16 FP60 (6.0.16.60)
     7 R1 SR4 FP20  (7.1.4.20)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels