IT12010: SERVER-TO-SERVER SSL COMMUNICATION FAILS USING CA-SIGNED CERTIFICATES.

7.1.5.000-TIV-TSMSRV-AIX
7.1.5.000-TIV-TSMSRV-HP-UX
7.1.5.000-TIV-TSMSRV-Linuxppc64
7.1.5.000-TIV-TSMSRV-Linuxs390x
7.1.5.000-TIV-TSMSRV-Linuxx86_64
7.1.5.000-TIV-TSMSRV-SolarisSPARC
7.1.5.000-TIV-TSMSRV-WIN
6.3.6.000-TIV-TSMALL-Linuxx86_64
6.3.6.000-TIV-TSMALL-Linuxs390x
6.3.6.000-TIV-TSMALL-AIX
6.3.6.000-TIV-TSMALL-Linuxppc64
6.3.6.000-TIV-TSMALL-HP-UX
6.3.6.000-TIV-TSMSTA-WindowsI32
6.3.6.000-TIV-TSMALL-WindowsX64
6.3.6.000-TIV-TSMALL-SolarisSPARC
6.3.6.000-TIV-TSMAC-AIX
6.3.6.000-TIV-TSMAC-Linuxs390x
6.3.6.000-TIV-TSMAC-Linuxx86
6.3.6.000-TIV-TSMAC-SolarisSPARC
6.3.6.000-TIV-TSMAC-WindowsI32
6.3.6.000-TIV-TSMAC-WindowsX64
6.3.6.000-TIV-TSMRPT-WindowsX64
6.3.6.000-TIV-TSMRPT-WindowsI32
6.3.6.000-TIV-TSMRPT-Linuxx86_64
6.3.6.000-TIV-TSMRPT-Linuxx86
6.3.6.000-TIV-TSMRPT-AGENT-Windows
6.3.6.000-TIV-TSMRPT-AIX
6.3.6.000-TIV-TSMRPT-AGENT-AIX
6.3.6.000-TIV-TSMRPT-AGENT-Linux
IBM Spectrum Protect Server V7.1 Fix Pack 5 (7.1.5.000) Downloads
IBM Tivoli Storage Manager V6.3 Fix Pack 6 (6.3.6.000) Server Downloads

APAR status

• Closed as program error.

Error description

• Error Description: Server-to-server SSL communication fails when
  using CA-signed certificates and when the "TSM Server
  SelfSigned SHA Key" label has been deleted from the key
  database. This error message will appear in the activity log:
  
  
  
  
  
  ANR8582E An SSL open-socket error occurred on session <###>.
    The GSKit return code is 575051
  
  
  
  
  Tivoli Storage Manager Versions Affected: 6.3, 7.1
  
  
  
  
  Initial Impact: Medium
  
  
  
  Additional Keywords: secure socket, TLS
  

Local fix

• To work around this problem, delete the cert256.arm
  file and restart the Tivoli Storage Manager server. A new
  certificate and label will be created.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All Tivoli Storage Manager server users.                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See error description.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in levels 6.3.6 and 7.1.5.  Note that  *
  * this is subject to change at the discretion of IBM.          *
  ****************************************************************
  

Problem conclusion

• This problem was fixed.
  At startup, when SSL is being used, new message ARN3339I will
  display the
  default certificate label name as in the following example:
  
  ANR3339I Default Label in key data base is TSM Server SelfSigned
  SHA Key.
  Explanation:
  The default SSL label in the key data base is displayed.
  System Action:
  Server or storage agent operation continues.
  User Response:
  None.
  
  Affected platforms:  AIX, HP-UX, Solaris, and Linux
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM SERVER

• Fixed component ID

  5698ISMSV

Applicable component levels