PH61803: CMSKEYSTORE CREATION MAY FAIL FOR OLDER JAVA VERSION

APAR status

• Closed as program error.

Error description

• WAS may fail to create plugin-key.kdb file on older Java
  version.
  
  - Sample Error --
  [5/30/24 9:45:03:187 CEST] 00000077 WSKeyStore 3 Cannot load
  the Java keystore at location
  "/users/was80/profiles/base01/wstemp/Script18fc8751455/workspace
  /cells/cell_yval3y10/nodes/base01/servers/hwo40_HelloWorld_HWO_w
  s/plugin-key.kdb" on the local node.
  [5/30/24 9:45:03:187 CEST] 00000077 WSKeyStore 3 Exception
  executing KeyStore method.
  com.ibm.websphere.crypto.KeyException: Cannot load the Java
  keystore at location
  ------------
  
  ------- SSL=all trace shows the following pattern
  [5/30/24 9:45:03:186 CEST] 00000077 CMSKeyStoreUt 3 Not using
  PQC value when loading CMS Keystore. This happens when
  WebSphere is running on zOS platform or IBM i platform or
  com.ibm.websphere.security.cms.usepqc custom property is set
  to false
  [5/30/24 9:45:03:186 CEST] 00000077 CMSKeyStoreUt 3
  CMSProvider V3 has been loaded successfully.
  [5/30/24 9:45:03:186 CEST] 00000077 CMSKeyStoreUt 3
  com.ibm.security.cmskeystore.CMSLoadStoreParameterFactory has
  bee loaded.
  [5/30/24 9:45:03:186 CEST] 00000077 CMSKeyStoreUt 3
  newCMSLoadParameter() with 3 params was not found. Calling
  without pqc.
  [5/30/24 9:45:03:186 CEST] 00000077 CMSKeyStoreUt 3 loadParm
  is null  <==== This should not be null.
  -------------------------------------
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  who applied PH60850 or PH57998              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Error : "Cannot load the Java keystore  *
  *                      at                                      *
  *                      location error for plugin-key.kdb"      *
  ****************************************************************
  * RECOMMENDATION:  It is recommended to update Java to a newer *
  *                  version to resolve this issue.              *
  ****************************************************************
  When WebSphere cannot find a recently introduced Java API for
  creating a plugin-key.kdb, it defaults to using an older version
  of
  the API. A bug in the code area prevents the necessary
  parameters
  from being returned to create the keystore.
  

Problem conclusion

• The bug has been fixed.
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.26 and 9.0.5.21. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels