IT40694: The runmqakm command does not report an error when the target file is not writable

APAR status

• Closed as program error.

Error description

• Customer use runmqakm command in their automation scripting for
  qmgr config, for example:
  .
      $ /opt/mqm/bin/runmqakm -cert -sign -file CSR_file -db
  THE_kdb -label THT_label -target CSR_file.cer -format ascii
  -expire 3650 -sigalg sha256 -stashed
  .
  When the target file CSR_file.cer exists but is not writable,
  the runmqakm command completes without any output, the exit
  code is 0.
  .
      $ echo $?
      0
  .
  But the command fails to write data to the target file, the
  target file is not renewed.
  .
  The runmqakm command should return a non-zero exit code if it
  fails to write to the target file.
  

Local fix

• Ensure that the target file is writeable.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users managing SSL certificates with the runmqakm utility.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  While signing a certificate request file with runmqakm -cert
  -sign, if the .cer file does not have write permission enabled
  for the calling user, this will fail silently, and return 0 even
  though the signing did not complete.
  

Problem conclusion

• This issue is addressed by updated to GSKit 8.0.55.31 or later.
  With this level of GSKit, runmqakm will now handle failed write
  permissions correctly and report an error when it fails in this
  way.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.2 LTS   9.2.0.15
  v9.3 LTS   9.3.0.6
  v9.x CD    9.4.1
  
  The latest available maintenance can be obtained from
  'IBM MQ Recommended Fixes'
  https://www.ibm.com/support/pages/recommended-fixes-ibm-mq
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'IBM MQ
  Planned Maintenance Release Dates'
  https://ibm.biz/mqplannedmaintenance
  
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.2

• Fixed component ID

  5724H7281

Applicable component levels