IT21101: DURING MIGRATION THE WEB SERVER KEYSTORE CONTENTS MAY NOT BE PROPERLY MIGRATED.

IBM Spectrum Control V5.2.15 (August 2017)
IBM Spectrum Control V5.2.15.2 (November 2017)
IBM Spectrum Control V5.2.16 (March 2018)
IBM Spectrum Control V5.2.17 (May 2018)

APAR status

• Closed as program error.

Error description

• During upgrade pre-5.2.14 Web Browser eWAS keystore contents
  aren't being properly migrated.
  This results in browser connections being flagged as unsecure or
  untrusted.
  By default Spectrum Control uses Self Signed certificates.
  Customers who have implemented their own Certificate Authority
  Signed certificates will be required to regenerate the signed
  certs.
  .
  RECREATE STEPS:
  Install a version of Spectrum Control at an older release than
  5.2.14.  Implement Signed certificates for use with the prefered
  Browser, ensure the connections are showing as Secure/Trusted.
  Run upgrade to 5.2.14.  Open the Web GUI in your browser and you
  should see an untrusted/insecure connection warning.
  .
  Problem as described by customer: Browser connection reflects an
  Insecure or untrusted connection.  Message varies with Browser.
  Initial customer impact (low/med/high):low
  

Local fix

• Regenerate certificates using the documented steps in Knowledge
  Center.  The 5.2.14 knowledge center steps are correct however
  the Web Server was omitted. The process/steps are the same
  between Web Server, Alert Server and Device Server, the only
  differences are the directory locations.
  https://www.ibm.com/support/knowledgecenter/SS5R93_5.2.14/com.ib
  m.spectrum.sc.doc/cfg_replace_SSL_certificates_servers.html
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control 5.2.x users migrating to Spectrum       *
  * Control 5.2.14                                               *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * During upgrade pre-5.2.14 Web Browser eWAS keystore contents *
  * aren't being properly migrated.  This results in browser     *
  * connections being flagged as unsecure or untrusted.          *
  * By default Spectrum Control uses Self Signed certificates.   *
  * Customers who have implemented their own Certificate         *
  * Authority Signed certificates will be required to regenerate *
  * the signed certs.                                            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance when available                         *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following maintenance
  package:
  
  | refresh pack | 5.2-TIV-TPC-RP0015 - target August 2017
  
  Fixed in IBM Spectrum Control 5.2.15
  
  http://www.ibm.com/support/docview.wss?&uid=swg21320822
  
  The target dates for future refresh packs do not represent a
  formal commitment by IBM. The dates are subject to change
  without notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels