IJ05409: RECEIVE JKS CERTIFICATE,V1STASH PROBLEM WHEN V2 EXISTS,YEAR 2038 PASSWORD EXPIRY,CMS KEYSTORE WITH RESTRICTED POLICY

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• 1. Receive JKS certificate
  Receive JKS certificate does not delete the cert request file.
  Two cert files appear in iKeyman tool.
  2. V1 stash problem when v2 stash exists
  The user attempts to create a v1stash file from the provided
  password, but since v2stash exists in the current folder,
  ikeyman disallows the downgrade of v2 stash file. Ideally,
  downgrade should happen if the password is provided.
  3. Year 2038 password expiry issue
  When password expiry pass the 2038 cut-off (+20 years), iKeyman
  incorrectly reports "database password expired".
  4. CMS keystore with restricted policy
  Attempting to change the password of a CMS keystore type results
  in zero byte keystore file along with the exception:
  java.io.IOException: Error initialising cipher.  The problem
  occurs with keytool command when restricted jurisdiction policy
  files are used.The same problem occurs with iKeyman tool as
  well.  The problem goes away when unrestricted jurisdiction
  policy files are used for both ikeyman and keytool.
  

Problem conclusion

• 1. Receive JKS certificate
  The certificate request file is deleted after receive JKS
  certificate is executed successfully.
  2. V1 stash problem when v2 stash exists
  Downgrade of a stash file from v2 to v1 is allowed if the
  password is provided.
  3. Year 2038 password expiry issue
  This is a bug in iKeyman and is fixed in this release.
  4. CMS keystore with restricted policy
  CMSProvider is updated to throw an exception that iKeyman can
  interpret as likely being a restricted policy file issue.
  iKeyman will then report this error
  .
  This APAR will be fixed in the following Java Releases:
     8    SR5 FP15  (8.0.5.15)
     7    SR10 FP25 (7.0.10.25)
     7 R1 SR4 FP25  (7.1.4.25)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels