PK67192: CREATED KEY STORES VIA ADMIN CONSOLE REPORTED INCONSISTENT AT SERVER LEVEL TOPOLOGY, WHICH CAUSE FAILURE TO READ THE .JKS FILE

Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• If you have created jks certificate using following link which
  show correct type
  
  SSL certificate and key management > Key stores and certificates
  
  Name: dummy
  
  Path:
  /tmp/DummyServerKeyFile.jks
  
  Type also shows the jks
  
  But after going through other panel which show type PKCS12 which
  cause the problem.
  
  SSL certificate and key management > Manage endpoint security
  configurations > server1 > Key stores and certificates > dummy
  
  In addition to confirming the differences, reviewed the document
  sent by the customer and noticed that the message was issued by
  a web browser. This means that the certificate sent by the
  browser was not trusted by the server.  To establish trust, the
  signer certificate of the browser must be in the truststore
  used by the server, by default the trust.p12 file.  If using
  the admin console this can be found in,
  
  SSL certificate and key management > Key stores and certificates
  > CellDefaultTrustStore
  
  or
  
  SSL certificate and key management > Key stores and certificates
  > NodeDefaultTrustStore
  
  The reason a browser would be required to send a certificate
  would be because client authentication is enabled for the ssl
  setting in use by the server. To find out, please go to this
  panel,
  
  SSL certificate and key management > SSL configurations >
  CellDefaultSSLSettings > Quality of protection (QoP) settings
  
  or
  
  SSL certificate and key management > SSL configurations >
  NodeDefaultSSLSettings > Quality of protection (QoP) settings
  
  and see the "Client Authentication" drop down menu.
  
  In summary, there is the inconsistent keystore type being
  reported by the admin console and an APAR is needed for that.
  

Local fix

• Workaround - if you try to create using different panel in
  console which show correct type.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of WebSphere Application Server   *
  ****************************************************************
  * PROBLEM DESCRIPTION: For WebSphere Application Server,       *
  *                      the keystore information displayed is   *
  *                      incorrect when the current scope does   *
  *                      not match the management scope of the   *
  *                      actual keystore being viewed. For       *
  *                      example, if the scope is at the node    *
  *                      level and the management scope for      *
  *                      the keystore is at the cell level,      *
  *                      then the type displayed defaults to     *
  *                      PKCS12 even when the actual type is     *
  *                      JKS.                                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When a user attempts to display the details for a
  given keystore, the user needs to navigate through the
  administrative console to the desired SSL configuration in the
  "SSL certificate and key management" panel. When a
  configuration is chosen, the scope in which the configuration
  was selected is used to query the resources for the
  configuration. This action will select the resources,
  keystores and truststores, that are within the scope up to the
  cell scope. Finally, when the details for the resources are
  queried the scope used does not match the management scope for
  the resource. This will cause default information to be
  displayed instead of the actual details from the resource.
  

Problem conclusion

• The code was modified such that the correct scope is used to
  query the keystores available from the security.xml file.
  
  The fix for this APAR is currently targeted for inclusion in
  fixpack 6.1.0.21.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPH APP SERV

• Fixed component ID

  5724J0800

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61I PSY

     UP

• R61P PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R61Z PSY

     UP