IBM Support

PI71789: InvalidNameException: Validation of the Collective DN failed. 0th element type was not dc

Fixes are available

16.0.0.4: WebSphere Application Server Liberty 16.0.0.4
17.0.0.1: WebSphere Application Server Liberty 17.0.0.1
17.0.0.2: WebSphere Application Server Liberty 17.0.0.2
17.0.0.3: WebSphere Application Server Liberty 17.0.0.3
17.0.0.4: WebSphere Application Server Liberty 17.0.0.4
18.0.0.1: WebSphere Application Server Liberty 18.0.0.1
18.0.0.2: WebSphere Application Server Liberty 18.0.0.2
18.0.0.3: WebSphere Application Server Liberty 18.0.0.3
18.0.0.4: WebSphere Application Server Liberty 18.0.0.4
19.0.0.1: WebSphere Application Server Liberty 19.0.0.1
19.0.0.2: WebSphere Application Server Liberty 19.0.0.2
19.0.0.3: WebSphere Application Server Liberty 19.0.0.3
19.0.0.4: WebSphere Application Server Liberty 19.0.0.4
19.0.0.5: WebSphere Application Server Liberty 19.0.0.5
19.0.0.6: WebSphere Application Server Liberty 19.0.0.6
19.0.0.7: WebSphere Application Server Liberty 19.0.0.7
19.0.0.8: WebSphere Application Server Liberty 19.0.0.8
19.0.0.9: WebSphere Application Server Liberty 19.0.0.9
19.0.0.10: WebSphere Application Server Liberty 19.0.0.10
19.0.0.11: WebSphere Application Server Liberty 19.0.0.11
19.0.0.12: WebSphere Application Server Liberty 19.0.0.12
20.0.0.1: WebSphere Application Server Liberty 20.0.0.1
20.0.0.2: WebSphere Application Server Liberty 20.0.0.2
20.0.0.3: WebSphere Application Server Liberty 20.0.0.3
20.0.0.4: WebSphere Application Server Liberty 20.0.0.4
20.0.0.5: WebSphere Application Server Liberty 20.0.0.5
20.0.0.6: WebSphere Application Server Liberty 20.0.0.6
20.0.0.7: WebSphere Application Server Liberty 20.0.0.7
20.0.0.8: WebSphere Application Server Liberty 20.0.0.8
20.0.0.9: WebSphere Application Server Liberty 20.0.0.9
20.0.0.10: WebSphere Application Server Liberty 20.0.0.10
20.0.0.11: WebSphere Application Server Liberty 20.0.0.11
20.0.0.12: WebSphere Application Server Liberty 20.0.0.12

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • An issue can occur on Liberty when the collective member
    can't
    communicate with the collect controller after replacing
    default
    certificates with internal certificates.
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server Liberty who configured the           *
    *                  collective function with a CA (Certificate  *
    *                  Authority) certificate                      *
    ****************************************************************
    * PROBLEM DESCRIPTION: Error message with                      *
    *                      "javax.naming.InvalidNameException:     *
    *                      Validation of the Collective DN failed" *
    *                      is printed in the log                   *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    After the collective function is configured to use a CA
    certificate,  javax.naming.InvalidNameException is thrown.
    Following is the sample error.
    
    --- Sample error ---
    Stack Dump = javax.naming.InvalidNameException: Validation of
    the Collective DN failed. 0th element type was not dc. DN:
    CN=liberty_collective, OU=WASE eComm, O=Test Corporation,
    L=MyCity, ST=My State, C=US
    	at
    com.ibm.ws.collective.security.CollectiveDNUtil.validateCollecti
    veDNSyntax(CollectiveDNUtil.java:280)
    	at
    com.ibm.ws.collective.security.CollectiveDNUtil.getHostName(Coll
    ectiveDNUtil.java:358)
    	at
    com.ibm.ws.collective.member.internal.security.CollectiveIdentit
    yValidator.validateServerIdentity(CollectiveIdentityValidator.ja
    va:259)
    	at
    com.ibm.ws.collective.member.internal.security.CollectiveIdentit
    yValidator.access$300(CollectiveIdentityValidator.java:61)
    	at
    com.ibm.ws.collective.member.internal.security.CollectiveIdentit
    yValidator$ScheduledValidate.call(CollectiveIdentityValidator.ja
    va:194)
    	at
    com.ibm.ws.collective.member.internal.security.CollectiveIdentit
    yValidator$ScheduledValidate.call(CollectiveIdentityValidator.ja
    va:133)
    	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    	at
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExec
    utor.java:1142)
    	at
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExe
    cutor.java:617)
    -----------------------------------------------------
    

Problem conclusion

  • Collective function was checking the certificate's DN name
    against the default DN name even though a CA certificate is
    being used.
    The code has been updated so this unnecessary check will not be
    invoked.
    
    Note:  This error is also thrown when following configuration is
    missing for collective CA configuration.
    <collectiveCertificate rdn="name=value"></collectiveCertificate>
    Please also make sure that this is configured and refer to
    following page for configuration details.
    http://www.ibm.com/support/knowledgecenter/SSAW57_liberty/com.ib
    m.websphere.wlp.nd.doc/ae/twlp_config_collective_3rd_party_cert.
    html
    
    The fix for this APAR is currently targeted for inclusion in fix
    pack 16.0.0.4.  Please refer to the Recommended Updates page for
    delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PI71789

  • Reported component name

    LIBERTY PROFILE

  • Reported component ID

    5724J0814

  • Reported release

    CD0

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-11-03

  • Closed date

    2016-12-14

  • Last modified date

    2016-12-14

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    LIBERTY PROFILE

  • Fixed component ID

    5724J0814

Applicable component levels

  • RCD0 PSY

       UP

[{"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"CD0","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
19 October 2021