IV68757: ELEMENTS ORDERING ISSUE IN CERTIFICATEEXTENSIONS

APAR status

• Closed as program error.

Error description

• Error Message: Intermitted "Invalid PKCS#10 signature"
  SignatureException was seen when doing signature verification
  for certificate request.
  .
  Stack Trace: N/A
  .
  N/A
  

Local fix

• N/A
  

Problem summary

• Elements ordering issue in CertificateExtensions
  

Problem conclusion

• CertificateExtensions uses ConcurrentHashMap to store the
  elements. However, ConcurrentHashMap cannot preserve the
  insertion order of elements. This order difference leads to the
  signature verification failure of the certificate request and
  the "Invalid PKCS#10 signature" SignatureException.The fix is to
  use a map which preserves the elements order.The associated RTC
  PR is 60316The associated Austin CMVC defect is 115373The
  associated Hursley CMVC defect is 202144JVMs affected : Java
  5.0, Java 6.0, Java 6.1, Java 7.0, Java 7.1he fix was delivered
  for Java 5.0 SR16FP6, Java 6.0 SR16, Java 6.1 SR8, Java 7.0 SR7,
  Java 7.1 SR1The affected jar is "ibmpkcs.jar".The build level of
  this jar for the affected releases is "20140324"
  .
  This APAR will be fixed in the following Java Releases:
     7 R1 SR1       (7.1.1.0)
     6    SR16      (6.0.16.0)
     5.0  SR16 FP6  (5.0.16.6)
     6 R1 SR8       (6.1.8.0)
     7    SR7       (7.0.7.0)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the Service
  Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

• N/A
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IV68758

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R260 PSY

     UP

• R600 PSY

     UP