PH22557: CREATING A CUSTOM CA CLIENT BY IMPLEMENTING WSPKICLIENT INTERFACE PROVIDED BY WEBSPHERE FAILED CLASS LOADER

APAR status

• Closed as program error.

Error description

• WebSphere publicly available WSPKIClient api failed to load by
  classloader.
  
  WSPKIClient
  WSPKIClient interface that can be
  used to connect to a Certificate Authority (CA) and request a
  certificate, revoke a certificate, and query to see if a
  certificate creation has completed.
  [18/02/20 15:36:18:508 EST]
  FFDC Exception:java.lang.ClassNotFoundException SourceId:com.ibm
  .ws.ssl.commands.RevokeCACertificate.afterStepsExecuted
  ProbeId:283 Reporter:com.ibm.ws.ssl.commands.personalCertificate
  s.RequestCACertificate@8b158967
  java.lang.ClassNotFoundException
  : <custom class name>
   at java.lang.Class.forNameImpl(Native
  Method)
   at java.lang.Class.forName(Class.java:332)
   at com.ibm.
  ws.ssl.commands.personalCertificates.RequestCACertificate.caCert
  ificateRequest(RequestCACertificate.java:355)
   at com.ibm.ws.ssl
  .commands.personalCertificates.RequestCACertificate.afterStepsEx
  ecuted(RequestCACertificate.java:284)
   at com.ibm.websphere.mana
  gement.cmdframework.provider.AbstractTaskCommand.executeReal(Abs
  tractTaskCommand.java:855)
   at com.ibm.websphere.management.cmdf
  ramework.provider.AbstractTaskCommand.execute(AbstractTaskComman
  d.java:807)
   at com.ibm.ws.console.security.Certificates.CACerts
  DetailAction.createCACertificate(CACertsDetailAction.java:181)
  
  at com.ibm.ws.console.security.Certificates.CACertsDetailAction.
  execute(CACertsDetailAction.java:106)
  
  If the client adds the
  custom class to the server associated shared library, this
  class is now loaded by the JarExtClassloader while the com.ibm.w
  s.ssl.commands.personalCertificates.RequestCACertificate class
  is probably loaded from the OSGi Classloader so the custom
  class will not be visible to our RequestCACertificate class.
  Therefore, The ClassNotFoundException is thrown.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server that implemented a WSPKIClient       *
  *                  plugin to access a certificate authority    *
  *                  (CA)                                        *
  ****************************************************************
  * PROBLEM DESCRIPTION: There is a loading error when           *
  *                      WebSpher is configured to use a         *
  *                      WSPKIClient implementation  to access   *
  *                      a CA.                                   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When a user implements a WSPKICLient to access a CA, WebSphere
  is failing to load that implementation.
  

Problem conclusion

• Fix the WebSphere application server to fall back to the
  extension class loader when there is a failure to load a
  custom WSPKIClient implementation.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.18 and 9.0.5.5.  For more information, see 'Recommended
  Updates for WebSphere Application Server':
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP