IJ15122: DIFFERENT IKEYMAN/IKEYCMD BEHAVIOUR IN JAVA8 VS JAVA7

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  

Local fix

• The workaround to list all the certificates in the chain in Java
  8 PKCS12 keystore similar to Java7, is to either import or
  convert the keystore. This will add signers as seperate aliases
  (with X500 subject DN of the certificate as alias).
  ikeycmd -cert -import -db <dbName> -pw <password> -target <new
  dbName> -target_type <db type> -label <cert alias>
  -target_pw <target password>
  or
  >ikeycmd -keydb -convert -db <dbName> -pw <password> -target
  <same or new dbName> -new_format <db type>
  

Problem summary

• According to the problem report, customer compared ikeycmd on
  both Java 7 and Java8. The ikeycmd on Java 7 showed all
  certificates in the chain, from leaf to parent,  But the one on
  Java 8 only showed the leaf certificate. The problem is, in IBM
  Java 7, PKCS12 was implemented to auto generate signer aliases
  for personal certificates.  In  Java 8, as PKCS12 implementation
  was closely aligned with Oracle and other PKCS12 providers, it
  was changed to not auto generate signer aliases. This resulted
  in difference in keystore entries between Java 7 and Java 8 for
  PKCS12 keystore.
  

Problem conclusion

• To fix this issue, iKeyman/iKeycmd has provided 1. a workaround
  to list all the certificates in certificate chain similar to
  Java 7 and 2. a solution to validate the personal certificate
  with missing root or intermediate certificates by retrieving the
  signer certificate from certificate chain in certificate's key
  entry in the keystore.
  .
  This APAR will be fixed in the following Java Releases:
     8    SR5 FP35  (8.0.5.35)
     7    SR10 FP45 (7.0.10.45)
     7 R1 SR4 FP45  (7.1.4.45)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels