IBM Support

PI85356: UNABLE TO DELETE KEYSTORES - CORRUPTED DELETED.P12

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Customer cannot delete certificates from any key or trust
    store.  This is because of a corrupted deleted.p12 file.  The
    customer is trying to deploy new certs and when they manually
    try to delete an old certificate in the admin console, it shows
    up "null".
    

Local fix

  • Delete the old certificate without saving it in the deleted.p12.
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server                                      *
    ****************************************************************
    * PROBLEM DESCRIPTION: Certificate deletion fails when         *
    *                      deleted.p12 file does not exist or is   *
    *                      corrupted.                              *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    When deleting certificate, WebSphere first saves the
    certificate
    in keystore named deleted.p12 so it can be retrieved later
    just
    in case.  If  deleted.p12 is not found or deleted.p12 is not
    a
    valid keystore, WebSphere fails to delete certificate.
    

Problem conclusion

  • Following custom property was introduced by this apar.
    
    com.ibm.ssl.skipSaveInDeletedKeyStore
    
    If it is set to true, WebSphere deletes certificate without
    saving it in deleted.p12.  Default value is false.
    
    To set the custom property, from adminconsole, Global
    Security
    panel, click on "Custom Properties"
    (right bottom) and select "New" button,
    and enter following string in "Name" field
    com.ibm.websphere.security.skip.save.deleted.certs
    and true in "Value" field.
    Optionally add description and "Save"
    
    The property will be in effect after restarting the server.
    
    The fix for this APAR is currently targeted for inclusion in
    fix pack 8.0.0.15, 8.5.5.13 and 9.0.0.7.  Please refer to
    the
    Recommended Updates page for delivery information:
    http://www.ibm.com/support/docview.wss?
    rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PI85356

  • Reported component name

    WEBS APP SERV N

  • Reported component ID

    5724H8800

  • Reported release

    900

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2017-08-02

  • Closed date

    2017-11-13

  • Last modified date

    2019-05-14

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBS APP SERV N

  • Fixed component ID

    5724H8800

Applicable component levels

  • R800 PSY

       UP

  • R850 PSY

       UP

  • R900 PSY

       UP

[{"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"900","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
18 October 2021