IJ57756: CERTPATHBUILDER MAY FAIL WHEN TARGET CERTIFICATE IS PROVIDED DIRECTLY VIA X509CERTSELECTOR.SETCERTIFICATE()

APAR status

• Closed as program error.

Error description

• Error Message: java.security.cert.CertPathBuilderException: No
  end-entity certificate matching the selection criteria could be
  found.
  .
  Stack Trace: java.security.cert.CertPathBuilderException: No
  end-entity certificate matching the selection criteria could be
  found. at
  com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCe
  rtPathBuilderImpl.java:229)
  at
  java.security.cert.CertPathBuilder.build(CertPathBuilder.java:25
  6)
  .
  

Local fix

• Add the target certificate to a CertStore and configure it in
  PKIXBuilderParameters before invoking CertPathBuilder.
  

Problem summary

• The PKIXCertPathBuilder implementation did not honor the target
  certificate specified through X509CertSelector.setCertificate().
  The builder attempted to locate the certificate only through
  configured CertStores, causing certificate path building to fail
  if the certificate was not available in a CertStore.
  

Problem conclusion

• The CertPathBuilder implementation has been updated to honor the
  target certificate specified through
  X509CertSelector.setCertificate().
  GIT issues: CERTPATH: 106
  RTC problem report: 153859
  The affected files: ibmcertpathprovider.jar
  ibmcertpathprovider.jar build dates: 20260220
  Build: 7.0 build_20260220-5
  The fixes were delivered for: Java 7.1 SR5 FP30
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
  IBM SDK, Java Technology Edition
     7 R1 SR5 FP30  (7.1.5.30) (restricted access)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
    - IBM Semeru Runtimes, Version 11 and later
      https://www.ibm.com/semeru-runtimes/downloads/
    - IBM SDK, Java Technology Edition, Version 8
      https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
    - Java SDK Products on z/OS
      https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

• Add the end-entity certificate to a CertStore before invoking
  CertPathBuilder.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels