IT36588: IBM MQ reports "AMQ9671: The PKCS #11 token password specified is invalid" when the password is correct 

APAR status

• Closed as program error.

Error description

• MQ client was configured with SSLCryptoHardware requiring a
  user id and password as configured in the SSL stanza of the
  mqclient.ini.
  
  The same failure is seen when using a queue manager with an
  encrypted <span style="background-color:rgb(255, 255,
  255)">SSLCryptoHardware </span>password value.
  
  AMQ9671E: The PKCS #11 token password specified is invalid.
  
  EXPLANATION:
  The password to access the PKCS #11 token is invalid. This is
  specified to MQ in the PKCS #11 token password field of the
  GSK_PKCS11 SSL  CryptoHardware parameter. The channel is
  'XXX.TO.YYY'; in some cases its name cannot be determined and so
  is shown as '????'. The channel did not start.
  
  ACTION:
  Ensure that the PKCS #11 token password specified on GSK_PKCS11
  allows access to the PKCS #11 token specified on GSK_PKCS11.
  Restart the channel.
  
  Also, AMQ9629 error is reported when a string longer than
  256bytes is supplied for Client Cryptographic Hardware
  configuration
  
  536909353  0x20009629  rrcE_SSL_BAD_CRYPTO_PARMS
  
  MESSAGE:
  Bad SSL cryptographic hardware parameters.
  
  EXPLANATION:
  The following string was supplied to specify or control use of
  SSL
  cryptographic hardware: '<insert two>'. This string does not
  conform to any of
  the MQ SSL cryptographic parameter formats. The channel is
  '<insert one>'. The
  channel did not start.
  
  ACTION:
  Correct your SSL cryptographic hardware parameters and restart
  the channel
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  MQ client users using the SSLCryptoHardware parameter of the
  mqclient.ini or qm.ini SSL stanza
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A logic error in the handling of password strings meant that
  decryption logic was not applied correctly to files where the
  token <span style="background-color:rgb(255, 255, 255)">password
  </span>was stored encrypted. Additionally, if the token password
  was not stored encrypted, this logic attempted attempt to
  decrypt the string regardless, corrupting the value.
  

Problem conclusion

• The ini file processing logic for <span
  style="background-color:rgb(255, 255, 255)">SSLCryptoHardware
  </span> has been updated to correctly process both encrypted and
  unencrypted token <span style="background-color:rgb(255, 255,
  255)">password </span>values.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.2 LTS   9.2.0.4
  v9.x CD    9.2.3
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.2

• Fixed component ID

  5724H7281

Applicable component levels