IJ40687: UPDATE KEYTOOL TO CREATE AKID FROM THE SKID OF THE ISSUING CERTIFICATE AS SPECIFIED BY RFC 5280

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• When using KeyTool to generate a certificate and have it signed
  with
              an existing CA, KeyTool creates the Authority Key
  Identifier
              extension based on the CA's public key.
              Section "4.2.1.1. Authority Key Identifier" of
  RFC5280 states the
              following: "Where a key identifier has been
  previously established,
              the CA SHOULD use the previously established
  identifier."
              So if the CA certificate was not generated by
  KeyTool, its Subject
              Key Identifier might have been generated slightly
  differently, i.e.,
              not just the public key but with some other pieces
  of data. The end
              result is that when the new certificate is used in
  TLS
              communication, the client may throw a validation
  error(although the
              CA is indeed in the trust store)
  

Problem conclusion

• KeyTool was modified to copy the signing certificate Subject Key
              Identifier extension value to the signed certificate
  Authority Key
              Identifier extension value.
              The associated Hursley RTC Problem Report is 147641
              The associated Austin GIT defect in IBMJCE#172
              JVMs affected: Java 7.0, Java 7.1 and Java 8.0
              The fix was delivered for:
                  Java 7.0 sr11 fp15  (build_20220614-658)
                  Java 7.1 sr15 fp15  (build_20220614-658)
                  Java 8.0 sr7 fp15   (build_20220614-657)
  
              The affected jar is ibmjceprovider.jar
  
  .
  This APAR will be fixed in the following Releases:
  .
  IBM SDK, Java Technology Edition
     8    SR7 FP15  (8.0.7.15)
     7 R1 SR5 FP15  (7.1.5.15)
     7    SR11 FP15 (7.0.11.15)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  maintenance can be found at:
             https://www.ibm.com/support/pages/java-sdk
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels