PH48456: KEYTOOL ENCOUNTERS KEYSTOREEXCEPTION: PRIVATE KEY IS NOT ENCODEDAS PKCS#8 WITH IBMJCECCA IN LIST

APAR status

• Closed as program error.

Error description

• Error Message: keytool error: java.security.KeyStoreException:
  Key protection algorithm not found:
  java.security.KeyStoreException: Private key is not encodedas
  PKCS#8
  .
  Stack Trace:
  .
  

Local fix

• Users should explicitly specify the keystore type by using the
  -storeType option. The keystore type given with the -storeType
  option is not case sensitive.
  Instead of:
  keytool -genkeypair -keyalg RSA -alias alias -keystore keystore
  -keypass password -storepass password -dname CN=IBM
  Users should use:
  keytool -genkeypair -keyalg RSA -storeType pkcs12 -alias alias
  -keystore keystore -keypass password -storepass password -dname
  CN=IBM
  

Problem summary

• There is an issue encountered in IBM Semeru Runtime Certified
  Edition for z/OS 11.0.15 for a certain case of the keytool
  command. This specific issue occurred because the default
  keystore type being used is "pkcs12", but the code checks for
  "PKCS12" (uppercase). Because the strings do not match, the
  -genkeypair command is improperly using IBMJCECCA (a ICSFToken
  key) when it should be using SunRsaSign (PKCS8 encoded key).
  

Problem conclusion

• The problematic String comparison has been changed to ignore the
  case
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtime Certified Edition
     11              11.0.16.0
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  maintenance can be found at:
             https://www.ibm.com/support/pages/java-sdk
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA Z/OS 64

• Fixed component ID

  620700104

Applicable component levels