PH34963: THE UNDERSCORES (_) IN DN NAME CAUSE PROFILE CREATION ERROR.

APAR status

• Closed as program error.

Error description

• After upgrading 9.0.5.6, customer started to get following
  error from profile creation.
  3008-737 A certificate attribute
  was not recognised.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: Profile fails to create if the          *
  *                      certificate CN value contians           *
  *                      characters not allowed in the subject   *
  *                      alternative name DNS entry.             *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Profile creation fails if the CN value of a certificate
  contains characters not allowed in the SAN extension of the
  server certificate.
  

Problem conclusion

• The CN value is checked for illegal characters during profile
  creation.  If some exist then the server certificate is
  created without SAN information.  Allowed characters are
  letters,
  digits, and hyphens.
  
  A check is also added to createSelfSignedCertificate,
  createChainedCertificate and createCertificateRequest to emit
  an error if illegal characters are used in the DNS entry of
  the SAN.
  
  This fix is targeted for 8.5.5.20 and 9.0.5.8
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP