IZ73187: JAVAX.NET.SSL.SSLKEYEXCEPTION PUBLIC KEY NOT TYPE RSA WHEN USING JAVA6

APAR status

• Closed as program error.

Error description

• javax.net.ssl.SSLKeyException: Public key not type RSA is
  thrown invalidly.  Java5 does not throw this error. This
  error can occur at all Service Refresh levels, including
  the base level of Java6. This error can occur in either
  31bit or  64bit  jvms.
  

Local fix

• users who have java5 installed *may* use the java5 version
  of the ibmjsseprovider2.jar in place of the java6 version
  *ONLY* if no java6 unique functions are NOT required.
  

Problem summary

• Cannot use DSA certificate using RSA cipher suite on Java 6.0.
  The following is shown in the trace:
  
  main, handling exception: javax.net.ssl.SSLKeyException: Public
  key not of type RSA
  main, SEND SSLv3 ALERT:  fatal, description = unexpected_message
  main, WRITE: SSLv3 Alert, length = 2
  [Raw write]: length = 7
  0000: 15 03 00 00 02 02 0a                               .......
  
  main, called closeSocket()
  
  ClientJsse: can't connect using: SSL_RSA_WITH_RC4_128_MD5
  javax.net.ssl.SSLKeyException: Public key not of type RSA
  javax.net.ssl.SSLKeyException: Public key not of type RSA
   at
  com.ibm.jsse2.RSAClientKeyExchange.<init>(RSAClientKeyExchange.j
  ava:95)
   at
  com.ibm.jsse2.ClientHandshaker.serverHelloDone(ClientHandshaker.
  java:640)
   at
  com.ibm.jsse2.ClientHandshaker.processMessage(ClientHandshaker.j
  ava:223)
   at com.ibm.jsse2.Handshaker.processLoop(Handshaker.java:617)
   at com.ibm.jsse2.Handshaker.process_record(Handshaker.java:554)
   at
  com.ibm.jsse2.SSLSocketImpl.readRecord(SSLSocketImpl.java:971)
   at
  com.ibm.jsse2.SSLSocketImpl.performInitialHandshake(SSLSocketImp
  l.java:1193)
   at
  com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:12
  20)
   at
  com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:12
  04)
   at ClientJsse.main(ClientJsse.java:166)
  

Problem conclusion

• This defect will be fixed in:
  6.0.0 SR8 FP1
  IBMJSSEProvider2.jar dated 20100325
  Hursley Defect 163742
  Austin Defect 110177
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R600 PSY

     UP