PH73391: Liberty JVMSERVERs generate malformed keystore locations in their server.xml when given a keyring owned by a specific userid.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• A CICS region is started with a keyring owned by a specific
  userid in the SIT parameters, for example:
  KEYRING=USERID/Ring.Name
  
  A Liberty JVMSERVER, which also includes the CMCI JVM server, is
  started with autoconfigure enabled and a custom keystore
  location, such as:
  
  -Dcom.ibm.cics.jvmserver.wlp.server.keystore.location=safkeyring
  
  This keystore location property does not include the :// suffix.
  
  As a result, the server.xml is generated with the following
  location attribute for the keystore, which includes one too many
  slashes in the suffix:
      "safkeyring:///USERID/Ring.Name"
  
  As a result, the keystore fails to load as this is an invalid
  location for a keyring owned by a specific userid. This leads
  to the following errors in the JVMSERVERs messages.log:
  
  com.ibm.ws.ssl.config.WSKeyStore E CWPKI0033E: The keystore
  located at safkeyringjce:///USERID/Ring.Name did not load
  because of the following error: R_datalib (IRRSDL00) error:
  profile for ring not found (8, 8, 84)
  
  com.ibm.ws.ssl.config.WSKeyStore W CWPKI0809W: There is a
  failure loading the defaultKeyStore keystore. If an SSL
  configuration references the defaultKeyStore keystore, then the
  SSL configuration will fail to initialize.
  

Local fix

• Update com.ibm.cics.jvmserver.wlp.server.keystore.location
  property in the JVMPROFILE to include the suffix '://'. For
  example: "safkeyring://"
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Invalid keystore location generated in  *
  *                      Liberty JVMSERVER server.xml when a     *
  *                      keyring owned by a specific userid is   *
  *                      used with a custom location specified.  *
  ****************************************************************
  CICS is started with a keyring specified which belongs to a
  specific USERID, such as "KEYRING=USERID/Ring.Name".
  
  A Liberty JVMSERVER, which also includes the CMCI JVM server, is
  started with autoconfigure enabled and a custom keystore
  location, such as:
  
  -Dcom.ibm.cics.jvmserver.wlp.server.keystore.location=safkeyring
  
  This location does not include the scheme separator (://). As a
  result, CICS attempts to add this itself but does not account
  for the fact a keyring belonging to a USERID was provided. As a
  result, the server.xml is populated with an invalid keystore
  location such as "safkeyring:///USERID/Ring.Name".
  
  This incorrectly generated location should have been
  "safkeyring://USERID/Ring.Name" as the USERID should be treated
  as the authority in the URI.
  
  This results in the keystore failing to load which leads to the
  following errors in the JVMSERVERs messages.log:
  
  com.ibm.ws.ssl.config.WSKeyStore E CWPKI0033E: The keystore
  located at safkeyringjce:///USERID/Ring.Name did not load
  because of the following error: R_datalib (IRRSDL00) error:
  profile for ring not found (8, 8, 84)
  
  com.ibm.ws.ssl.config.WSKeyStore W CWPKI0809W: There is a
  failure loading the defaultKeyStore keystore. If an SSL
  configuration references the defaultKeyStore keystore, then the
  SSL configuration will fail to initialize.
  

Problem conclusion

• CICS has been updated to ensure the correct keystore location is
  generated when given a custom keystore location and a keyring
  owned by a specific USERID.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PH72569

• APAR is sysrouted TO one or more of the following:

  UO09844 UO09845 UO09846

Modules/Macros

• DFJ@H571
  

Fix information

• Fixed component name

  CICS TS Z/OS V6

• Fixed component ID

  5655YA100

Applicable component levels

• R400 PSY UO09846

     UP26/10/07 I 1000

• R500 PSY UO09845

     UP26/10/07 I 1000

• R600 PSY UO09844

     UP26/10/07 I 1000

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.