IT21914: ON WINDOWS PLATFORMS, RETRIEVING AN SSL CERTIFICATE FROM THE OS CERTIFICATE STORE MIGHT FAIL FOR CLIENT PRODUCTS

Db2 Version 11.1 Mod 3 Fix Pack 3 for Linux, UNIX, and Windows
Db2 Version 11.1 Mod3 Fix Pack3 iFix001 for Linux, UNIX, and Windows
Db2 Version 11.1 Mod3 Fix Pack3 iFix002 for Linux, UNIX, and Windows

APAR status

• Closed as program error.

Error description

• You have installed a DB2 client products such as "Data Server
  Client" or "Data Server Driver" on a windows machine.
  You want to connect to a DB2 server via an SSL connection and
  decided to store the certificate needed in the Microsoft
  Certificate store and consequently set
  
     db2 update dbm cfg using SSL_CLNT_KEYDB
  GSK_MS_CERTIFICATE_STORE
     db2 update dbm cfg using SSL_CLNT_STASH NULL
  
  so that the client software search for it in the OS certificate
  store. The connection to the database might fail with
  
     SQL1109N  The command was not processed because the database
  manager failed to
     load the following DLL: "GSKit Error: 108".  SQLSTATE=42724
  
  This might happen if there is no GSKIt installed and added to
  the path.
  
  Client products don't require GSKit but instead come with a
  subset of the GSKit libraries under the "icc" or "icc64"
  directory. This subset is missing the library gsk8msca.dll
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * ALL                                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to Db2 11.1 Mod 3 Fix Pack 3 or higher               *
  ****************************************************************
  

Problem conclusion

• First fixed in Db2 11.1 Mod 3 Fix Pack 3
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IT13953

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 FOR LUW

• Fixed component ID

  DB2FORLUW

Applicable component levels

• RB10 PSN

     UP