IT39734: DSMC ENDS WITH RETURN CODE 12 ON RENEWING THE SELF-SIGNED CERTIFICATION DUE TO ANS1579E GSKKM_ERR_VALIDATION_KEY_VALIDITY_PERIOD

APAR status

• Closed as program error.

Error description

• dsmc incremental backup ends with return code 12, although the
  backup completes successful without failure.
  But the following error is recorded in dsmerror.log.
  
  ANS1579E GSKit function GSKKM_ValidateCert failed with 48:
  GSKKM_ERR_VALIDATION_KEY_VALIDITY_PERIOD
  
  This error is casused since self-signed client certification in
  spclicert.kdb is expired.
  The expiration period is set one year to the client certificate.
  
  
  In this situation, the client automatically renews the
  certificate after printing ANS1579E, and continues
  backup/archive operation without failure.
  But it ends with return code 12 due to ANS1579E.
  
  
  IBM Spectrum Protect Versions affected:
  IBM Spectrum Protect Client version  8.1.0 or later  on all
  supported platforms
  
  TS007730965
  
  Initial Impact: Low
  

Local fix

• The "workaround" is just to ignore RC=12 and error message.
  There's no impact on the backup operation - the client
  successfully updates self-signed certificate if it is expired,
  but the client still displaying error messages and RC=12 in this
  case, which can be ignored by the user.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Backup-Archive Client version 8.1       *
  * running on all platforms.                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * see ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * This issue is projected to be fixed in the Backup-Archive    *
  * client version 8.1.15 on all platforms.                      *
  *                                                              *
  * Note 1: This is subject to change at the discretion of IBM.  *
  ****************************************************************
  

Problem conclusion

• The issue has been fixed, so the client will not set RC=12 and
  ANS1579E message should not appear in error log when certificate
  is expired.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• dsmc
  

Fix information

• Fixed component name

  TSM CLIENT

• Fixed component ID

  5698ISMCL

Applicable component levels