IV43936: INCORRECT VERSION OF ENTRUST2048CA CERTIFICATE WITH IBM JDK 7

APAR status

• Closed as program error.

Error description

• Error Message: javax.net.ssl.SSLHandshakeException:
  com.ibm.jsse2.util.j: End user tried to act as a CA
  .
  Stack Trace: javax.net.ssl.SSLHandshakeException:
  com.ibm.jsse2.util.j: End user tried to act as a CA
  at com.ibm.jsse2.j.a(j.java:10)
  at com.ibm.jsse2.qc.a(qc.java:359)
  at com.ibm.jsse2.ab.a(ab.java:385)
  at com.ibm.jsse2.ab.a(ab.java:258)
  at com.ibm.jsse2.bb.a(bb.java:157)
  at com.ibm.jsse2.bb.a(bb.java:590)
  at com.ibm.jsse2.ab.r(ab.java:59)
  at com.ibm.jsse2.ab.a(ab.java:24)
  at com.ibm.jsse2.qc.a(qc.java:204)
  at com.ibm.jsse2.qc.h(qc.java:391)
  at com.ibm.jsse2.qc.a(qc.java:800)
  at com.ibm.jsse2.e.read(e.java:29)
  at java.io.InputStream.read(InputStream.java:113)
  .
  

Local fix

• Replace jre\lib\security\cacerts file in JDK 7 with
  jre\lib\security\cacerts file in JDK 6
  

Problem summary

• entrust2048ca certificate in JDK 7 cacerts does not contains
  Basic Constraints extension which identifies the certificate as
  a Certificate Authority.
  

Problem conclusion

• This defect will be fixed in:
  7.0.0 SR6
  .
  Cacerts file in JDK 7 has been updated with valid certificate
  having Basic Constraint extension. The new entrust certificate
  is added with alias name entrust2a048ca"
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA CLASS LIBS

• Fixed component ID

  620700130

Applicable component levels

• R700 PSY

     UP