IT43259: CERTIFICATE SIGNING REQUEST DOES NOT CONTAIN SAN INFORMATION

APAR status

• Closed as program error.

Error description

• When the default Self-Signed Certificate in IBM Spectrum Protect
  Plus needs to be replaced by a CA-Signed Certificate, a CSR
  (Certificate Signing Request) needs to be created on the IBM
  Spectrum Protect Plus Server. Instructions to create the CSR can
  be found at https://www.ibm.com/support/pages/how-set-https-cer
  tificate-ibm-spectrum-protect-plus-spp-microsoft-certificate-au
  thority.This CSR is missing SAN (Subject Alternate Name) informa
  causing certificates to be created without the following
  extended SAN attributes:
  - host DNS information
  - host IP address
  
  This can lead to failures during the verification of the
  certificate when opening IBM Spectrum Protect Plus GUI.
  
  
  
  IBM Spectrum Protect Plus Versions Affected:
  IBM Spectrum Protect Plus 10.1.x
  
  Additional Keywords: SPP, SPPlus, TS011803358, CA, Cert, CSR,
  SAN,
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus level 10.1.13 and 10.1.14.         *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in IBM Spectrum Protect Plus level     *
  * 10.1.14.1 and 10.1.15. Note that this is subject to change   *
  * at the discretion of IBM.                                    *
  ****************************************************************
  

Problem conclusion

• A script has been provided to generate signing request and key
  files when requesting certificates from a CA.  IBM Spectrum
  Protect Plus appliance has been updated to include the script at
  the following location: /opt/ECX/tools/scripts/generate_csr.sh
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• Other
  

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels