PH54618: UNSUPPORTEDOPERATIONEXCEPTION WHEN CREATING LTPA KEYS AFTER MOVING TO 22.0.0.12 WITH JAVA 11 ON Z/OS

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• After moving to 22.0.0.12 with Java 11, the following exception
  may be seen when the server generates LTPA keys on startup:
  
  java.lang.UnsupportedOperationException: Hardware error,
  function getPrivateExponent has no meaning in hardware
  at ibm.crypto.hdwrcca/com.ibm.crypto.hdwrCCA.provider.RSAPriva
  teHWKey.getPrivateExponent(RSAPrivateHWKey.java:86)
  at com.ibm.ws.crypto.ltpakeyutil.LTPACrypto.rsaKey(LTPACrypto.ja
  at com.ibm.ws.crypto.ltpakeyutil.LTPADigSignature.generateRSAKey
  (LTPADigSignature.java:49)
  at com.ibm.ws.crypto.ltpakeyutil.LTPADigSignature.generateLTPAKe
  (LTPADigSignature.java:76)
  at com.ibm.ws.crypto.ltpakeyutil.LTPAKeyFileUtilityImpl.generate
  (LTPAKeyFileUtilityImpl.java:50)
  at com.ibm.ws.security.token.ltpa.internal.LTPAKeyFileCreatorImp
  (LTPAKeyFileCreatorImpl.java:62)
  ...
  This problem only occurs when using IBMJCECCA as a provider on J
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of z/OS Liberty Embedded who       *
  *                 configures Hardware Crypto providers in      *
  *                 java.security file                           *
  ****************************************************************
  * PROBLEM DESCRIPTION: When the server generates LTPA keys on  *
  *                      startup, java.                          *
  *                      lang.UnsupportedOperationException      *
  *                      is thrown.                              *
  ****************************************************************
  The above error is thrown when the server starts up. As a
  result, LTPA authentication is unavailable.
  

Problem conclusion

• The bug has been fixed. For more details, please refer to the
  following Pull Request:
  https://github.com/OpenLiberty/open-liberty/issues/24955
  
  The fix for this APAR is targeted for inclusion in fix pack
  23.0.0.5. For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PH54691 UI91945

Modules/Macros

• BBL17002 BBL17004 BBL18003 BBL19009 BBL20009 BBL21009 BBL2203A
  BBL2303A BBLC2209 BBLS1704 BBLS1803 BBLS1909 BBLS2009 BBLS2109
  BBLS2303 BBLU1703 BBLU1801 BBLUNPAX
  

Fix information

• Fixed component name

  LIBERTY PROF -

• Fixed component ID

  5655W6514

Applicable component levels

• REM0 PSY UI91945

     UP23/10/02 P F309

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.