PM77262: DFHAM4928 INSTALL OF URIMAP FAILED BECAUSE THE SPECIFIED CERTIFICATE IS NOT YET CURRENT.

A fix is available

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • You renewed an SSL certificate and tried to bring the
    certificate in immediately. This caused the following error
    messages:
    DFHAM4889 Install of URIAMP failed because CERTIFICATE is
    invalid.
    DFHAM4928 Install of URIMAP failed because the specified
    certificate is not yet current.
    
    This problem is caused by a change made a few releases ago to
    ensure that ABSTIME values are always in local time.
    INQUIRE_TIME now always returns a local abstime value. However,
    the CONVERT_TIME routine that is called to convert the UTC time
    in the certificate to an ABSTIME value, just does a conversion
    of the format, producing a GMT ABSTIME instead of a local
    ABSTIME. CICS then compares the current time (local abstime)
    with the times specified on the certificate (GMT abstime) which
    is not valid.
    
    Additional Symptom(s) Search Keyword(s): KIXREVGJT
    

Local fix

  • Wait until local time has passed the GMT time specified on the
    certificate.
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: All.                                         *
    ****************************************************************
    * PROBLEM DESCRIPTION: Error message DFHAM4889 issued followed *
    *                      by DFHAM4928.                           *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    In the reported problem, a resource that used an SSL Certificate
    whose Start Date was after the UTC valid from Start Date would
    not install.
                                                                   .
    When a resource containing an SSL Certificate is installed then
    a DFHXSCT INQUIRE_CERTIFICATE call is made.  This call will
    ( amongst other things ) check the Start From and End Date
    timestamps that are in the Certificate and are specified in UTC
    format against the time that is returned from DFHTIMF routine
    Convert_Utctime.  This routine currently returns the time in
    local time and not UTC.
                                                                   .
    As a consequence, if the local time is behind UTC then it is
    possible the certificate will not install because it is deemed
    the Certificate is not yet valid.  Conversely, if the local
    time is ahead of GMT then the Certificate could be deemed to
    be expired when it still has time left to run.
    

Problem conclusion

  • DFHXSCT has been amended to compare the Certificate Start Date
    and End Date timestamps with local time adjusted to UTC.
    

Temporary fix

  • FIX AVAILABLE BY PTF ONLY
    

Comments

APAR Information

  • APAR number

    PM77262

  • Reported component name

    CICS TS Z/OS V4

  • Reported component ID

    5655S9700

  • Reported release

    700

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2012-11-16

  • Closed date

    2013-03-26

  • Last modified date

    2013-05-03

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    PM84623 UK93347

Modules/Macros

  •    DFHTIMF  DFHXSCT
    

Fix information

  • Fixed component name

    CICS TS Z/OS V4

  • Fixed component ID

    5655S9700

Applicable component levels

  • R700 PSY UK93347

       UP13/04/20 P F304

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.



Rate this page:

(0 users)Average rating

Document information


More support for:

CICS Transaction Server

Software version:

4.2

Reference #:

PM77262

Modified date:

2013-05-03

Translate my page

Machine Translation

Content navigation