IT31431: MQ appliance createcert and createcertrequest commands truncate last character of DN if escape character present

APAR status

• Closed as program error.

Error description

• On MQ Appliance, when creating a certificate or certificate
  request where an O(Organization) or OU(Organization Unit) in the
  distinguished name (DN) has an embedded comma escaped with the
  escape sequence '\,', the resulting DN is truncated with missing
  last character.
  
  Example:
  createcert -m QM1 -dn "CN=test,O=Org A\, Inc.,OU=Support,C=US"
  -label testcert
  also
  createcertrequest -m QM1 -dn "CN=test2,O=Org A\,
  Inc.,OU=Support, C=US" -label testcert2
  
  When showing details with detailcert command, the resulting DN
  is truncated.
  Subject : "CN=test,O=Org A\, Inc.,OU=Support,C=U"
  

Local fix

• <p>Avoid using escape character('\') in O or OU parameters of
  DN.</p><p> </p>
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Appliance users using SSL feature.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A logical error in MQ appliance code caused the createcert and
  createcertrequest commands to incorrectly copy the characters in
  DN(Distinguished Name) when an escape character('\') is present
  in DN, which in turn resulted in truncation of last character in
  DN.
  

Problem conclusion

• MQ appliance code has been modified to avoid truncation of last
  character in DN <span style="background-color:rgb(255, 255,
  255)">when an escape character('\'</span><span
  style="background-color:rgb(255, 255, 255)">) is present in
  DN.</span>
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 LTS   9.1.0.5
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ APPLIANCE M2

• Fixed component ID

  5737H4700

Applicable component levels