IV83526: CANNOT LIST CMS KEYSTORE USING KEYTOOL

APAR status

• Closed as program error.

Error description

• Error Message, as reported by customer:
  When trying to use keytool to list(in verbose mode) a CMS
  keystore, a NoSuchAlgorithmException with message
  "MessageDigest SHA-256 implementation not found" is seen.
  
  Stack Trace, if applicable:
  N/A
  
  Other Error Information, as reported by customer:
  N/A
  

Local fix

• N/A
  

Problem summary

• Cannot list CMS keystore using keytool
  
  
  ERROR DESCRIPTION:
  
  When trying to use keytool to list(in verbose mode) a CMS
  keystore, a NoSuchAlgorithmException with message "MessageDigest
  SHA-256 implementation not found" is seen
  

Problem conclusion

• Problem is IBM keytool doesn't fallback to use the provider
  supporting SHA-256 to continue to calculate digest value when
  CMS provider doesn't support SHA-256.
  
  The fix is to add the fallback mechanism to choose the one which
  supports the algorithm and continue calculation.
  
  The associated RTC PR is 111315
  The associated Austin CMVC defect is 117227
  The associated Austin APAR is IV83526
  
  JVMs affected : Java 6.0, Java 6.1, Java 7.0, Java 7.1 and Java
  8.0
  
  The fix was delivered for Java 6.0 SR16 FP30, Java 6.1 SR8 FP30,
  Java 7.0 SR9 FP50, Java 7.1 SR3 FP50 and Java 8.0 SR3 FP10
  
  The affected jar is "ibmjceprovider.jar".
  
  The build level of this jar for the affected releases is
  "20160425
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TIV JAVA CRYPTO

• Fixed component ID

  TIVSECJCE

Applicable component levels

• R100 PSY

     UP