IT24503: When using cryptographic hardware, SSL/TLS channel reports AM9642 with GSKit error 407

APAR status

• Closed as program error.

Error description

• An inbound SSL/TLS enabled client connection to  the QMgr fails
  with AMQ9642 (rrcE_SSL_NO_REMOTE_CERT).  This indicates that
  there is no certificate being presented by the client although
  one is present in the hardware cryptographic keyring.  The
  certificate is labelled correctly as ibmwebspheremq+userid.
  
  GSKIT returns error 407: GSK_ERROR_BAD_KEYFILE_LABEL.
  
  For example, the below is seen in
  the AMQ.SSL.TRC file :
  Error: Not Found. Label =
  <token label>:<token label>:ibmwebspheremqmyuserid
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of IBM MQ with cryptographic hardware.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A coding error when building the certificate label to pass to
  MQ's cryptographic provider meant that it was possible for MQ to
  prepend the PKCS #11 token label to the certificate label twice
  before the certificate label was validated. This caused the
  validation to fail.
  

Problem conclusion

• The MQ certificate management logic has been modified so that
  the token label is only appended once to the certificate label
  as expected.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.11
  v9.0 LTS   9.0.0.5
  v9.1 CD    9.1.1
  v9.1 LTS   9.1.0.1
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7251

Applicable component levels