IJ28547: CERTIFICATE PARSING ERROR

APAR status

• Closed as program error.

Error description

• Error Message: java.security.cert.CertificateException: Fail to
  parse input stream
  .
  Stack Trace: Exception in thread "main"
  java.security.cert.CertificateException: Fail to parse input
  stream
  at com.ibm.crypto.provider.X509Factory.b(Unknown Source)
  at
  com.ibm.crypto.provider.X509Factory.engineGenerateCertificates(U
  nknown Source)
  at
  java.security.cert.CertificateFactory.generateCertificates(Certi
  ficateFactory.java:448)
  at
  build.tools.blacklistedcertsconverter.BlacklistedCertsConverter.
  main(BlacklistedCertsConverter.java:81)
  .
  

Local fix

Problem summary

• The BlacklistedCertsConverter.java class failed to convert the
  blacklisted.certs.pem file.
  The following exception was thrown during the conversion:
  Exception in thread "main"
  java.security.cert.CertificateException: Fail to parse input
  stream
  at com.ibm.crypto.provider.X509Factory.b(Unknown Source)
  at
  com.ibm.crypto.provider.X509Factory.engineGenerateCertificates(U
  nknown Source)
  at
  java.security.cert.CertificateFactory.generateCertificates(Certi
  ficateFactory.java:448)
  at
  build.tools.blacklistedcertsconverter.BlacklistedCertsConverter.
  main(BlacklistedCertsConverter.java:81)
  

Problem conclusion

• The X509Factory.java class of the Java 8 IBMJCE provider was
  missing logic from its parseX509orPKCS7Cert(InputStream is)
  method.
  The affected jars are: ibmjceprovider.jar and ibmpkcs.jar for
  Java8, and ibmjceprovider.jar only for Java 7.0 and 7.1.
  The associated Hursley RTC Problem Report is 144354.
  The associated Austin Git issues is:  Issue#85 for IBMJCE, and
  Issue#80 for PKCS.
  JVMs affected include: Java 7.0, 7.1, and 8.0.
  The fix was delivered for Java 7.0 sr10 fp75, Java 7.1 sr4 fp75,
  and Java 8.0 sr6 fp25.
  
  
  
  The build level of the ibmjceprovider.jar delivered for Java 7.0
  and 7.1 is  build-356..
  .
  This APAR will be fixed in the following Java Releases:
     8    SR6 FP25  (8.0.6.25)
     7    SR10 FP75 (7.0.10.75)
     7 R1 SR4 FP75  (7.1.4.75)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels