IT30722: MQ client reports "AMQ9671:The PKCS #11 token password specifiedis invalid" when token password is correct

APAR status

• Closed as program error.

Error description

• <p>MQ client was configured with SSLCryptoHardware requiring a
  user id and password as configured in the SSL stanza of the
  mqclient.ini. The mq client fails to send the correct password
  and the following error is reported in the error log
  
  AMQ9671E: The PKCS #11 token password specified is invalid.
  
  EXPLANATION:
  The password to access the PKCS #11 token is invalid. This is
  specified to MQ in the PKCS #11 token password field of the
  GSK_PKCS11 SSL  CryptoHardware parameter. The channel is
  'C1.TO.QM1'; in some cases its name cannot be determined and so
  is shown as '????'. The channel did not start.
  
  ACTION:
  Ensure that the PKCS #11 token password specified on GSK_PKCS11
  allows access to the PKCS #11 token specified on GSK_PKCS11.
  Restart the channel.     </p>
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  MQ client users using <span style="background-color:rgb(255,
  255, 255)">SSLCryptoHardware parameter of SSL stanza to
  establish SSL connection</span>
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A logic error in MQ code caused the password supplied in the
  client ini file to be corrupted before being passed to the
  cryptographic provider (GSKit).
  

Problem conclusion

• MQ code has been modified to correctly pass the password string
  as retrieved from the ini file.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 CD    TBC.
  v9.1 LTS   9.1.0.5
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels