IBM Support

After upgrade to WebSphere Application Server 8.5.5.17 or 9.0.5.3 (with IBM SDK 8.0.6.0), NullPointerException occurs

Troubleshooting


Problem

After an upgrade of the underlying IBM SDK to version 8.0.6.0, there might be an issue starting your application server instance due to a null pointer exception related to the existing keystores in use.

Symptom

At startup, it might be observed that problems arise with starting the application server, and the log file can show messages that might appear unrelated, but the thread stacks reference NullPointerException messages related to certificate and key identifier components.
Examples:
  • ORBX0390E: Cannot create listener thread. Exception=[ org.omg.CORBA.INTERNAL: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_SERVER_SOCKET, Exception=com.ibm.websphere.ssl.SSLException: java.lang.NullPointerException vmcid: 0x49421000 minor code: 77 completed: No - received while attempting to open server socket on port 31416 ].
  • Caused by: java.lang.NullPointerException
    at com.ibm.security.x509.X509CertImpl.getIssuerKeyIdentifier(X509CertImpl.java:2950)
    at com.ibm.crypto.provider.PKCS12KeyStoreOracle.a(Unknown Source)
    at com.ibm.crypto.provider.PKCS12KeyStoreOracle.engineLoad(Unknown Source)
    at java.security.KeyStore.load(KeyStore.java:1456)
In addition, there might be FFDC files generated due to specific SSL/TLS components or Listeners.  More information can be seen in the FFDC file itself. 
  • FFDC1003I: FFDC Incident emitted on <<FFDC_FILE_PATH>> com.ibm.ws.orbimpl.transport.WSTransport.startListening
  • FFDC1003I: FFDC Incident emitted on <<FFDC FILE PATH>> com.ibm.ws.orbimpl.transport.WSTransport.createListener
  • FFDC1003I: FFDC Incident emitted on <<FFDC FILE PATH>> com.ibm.ws.ssl.provider.AbstractJSSEProvider
If the appserver did not start, the startup thread will display this message in the SystemOut.log:
  • WSVR0009E: Error occurred during startup

Cause

Due to changes in how the SDK is interpreting the keystore's certificate chains, the NullPointerExceptions occur.
Specifically, loading the certificates in the keystore, the Authority Key Identifier (AKI) cannot be determined precisely, usually due to a different type of key identifier in use than what is expected, and fails with the previously mentioned error.  These key identifiers are used to help form the complete chain for a certificate (see RFC5280 section 4.2.1.1, which describes the certificate extension "AuthorityKeyIdentifier"). 

Resolving The Problem

A fix for this issue was introduced into the IBM SDK in APAR IJ23018.  The fix alters how the SDK interprets the Key Identifiers in the keystore.
The recommendation is to upgrade to SDK version 8.0.6.10 or later to obtain the fix. 
You can apply these interim fixes to your installation of WebSphere Application Server.
IBM SDK 8.0.6.6 Interim Fix
These fixes are from a targeted build that includes the SDK version 8.0.6.6 with not only IJ23018, but two additional fixes related to keystores, IJ22800 and IJ23014.
IBM SDK 8.0.6.10 Interim Fix
More Information
Here's a link to the APAR in question:
And these related APARs (that were also included in the interim fix for 8.0.6.6)

Document Location

Worldwide

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"ARM Category":[{"code":"a8m50000000CcyMAAS","label":"Security->SSL"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.5.5;9.0.5","Line of Business":{"code":"LOB45","label":"Automation"}}]

Product Synonym

NullPointerException

Document Information

Modified date:
11 June 2020

UID

ibm16216059

Page Feedback