PH40572: RACFINPUTSTREAM CONSTRUCTOR THROWS JAVA.IO.IOEXCEPTION: FAILED VALIDATING CERTIFICATE PATHS

APAR status

• Closed as program error.

Error description

• Error Message: Exception in thread "main" java.io.IOException:
  Failed validating certificate paths
  .
  Stack Trace: Exception in thread "main" java.io.IOException:
  Failed validating certificate paths at
  com.ibm.crypto.provider.RACFInputStream.a(Unknown Source) at
  com.ibm.crypto.provider.RACFInputStream.(Unknown Source) at
  gimzipSignatures.GetCertificateDemo.main(GetCertificateDemo.java
  :26) Caused by:
  java.security.InvalidAlgorithmParameterException: Invalid at
  com.ibm.crypto.provider.d.a(Unknown Source) ... 3 more
  .
  

Local fix

• Add another certificate to the keyring
  

Problem summary

• The keystore cannot validate a trust chain if there is only one
  certificate in the keystore and it is not self signed.
  

Problem conclusion

• Added property ibm.hw.racfkeystore.trustchaincheck which when
  set to FALSE will disable the trust chain check for the
  JCECCARACFKS keystore. Added property
  ibm.racfkeystore.trustchaincheck which when set to FALSE will
  disable the trust chain check for the JCERACFKS keystore.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR7       (8.0.7.0)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels