PK51973: CAN'T REMOVE LAST CUSTOM TRUST MANAGER FROM AN SSL CONFIG

Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• Error removing a Custom Trust Manager from a SSL configuration.
  -
  This is the scenario that shows the problem:
   -
   1. Create a new Custom Trust Manager
    - SSL certificate and key management > Trust managers
    - Click new
    - Give a name
    - Click the custom button
     - enter this class name, com.ibm.test.CustomTrustManager
     - Click Appy, save
   2. Assign the Trust Manager to a SSL config
    - SSL certificate and key management >
       Manage endpoint security configurations >
       MyNode61-11 > SSL configurations
    - Select NodeDefaultSSLSettings
    - Click Trust and key managers
    - Highlight the Trust Manager in the "Additional ordered trust
      manager" left hand box
    - Click Add
    - Click Apply ; Save
   3. Attempt to unassign the Trust Manager from the SSL config
    - You should still be on
       SSL certificate and key management >
       Manage endpoint security configurations >
       MyNode61-11 > SSL configurations >
       NodeDefaultSSLSettings > Trust and key managers
    - Highlight the Trust Manager in the right hand box
    - click Remove
    - You will see the error.
   -
  Error in the log is:
   -
  java.lang.StringIndexOutOfBoundsException: String index out of
   range: -1
     at java.lang.StringBuffer.deleteCharAt(StringBuffer.java:367)
     at com.ibm.ws.console.security.SSLConfig.
        TrustKeyManagersDetailForm.setTrustManagers
        (TrustKeyManagersDetailForm.java:197)
     at com.ibm.ws.console.security.SSLConfig.
        TrustKeyManagersDetailForm.setSelectedTrustManagers
        (TrustKeyManagersDetailForm.java:146)
        ...
  

Local fix

• None
  KeyWords: repertoire security JSSE truststore
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: IBM WebSphere Application Server version     *
  *                 6.1 users.                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: HTTP 500 Internal server error occurs   *
  *                      in the Administrative Console upon      *
  *                      attempt to remove the last of any       *
  *                      "Additional ordered trust managers"     *
  *                      from an SSL configuration.              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  HTTP 500 Internal server error occurs in Administrative
  Console upon attempt to remove last of any "Additional ordered
  trust managers" from an SSL configuration.
  
  Trace.log will show the following error:
  SRVE0068E: Uncaught exception thrown in one of the service
  methods of the servlet: action.
  Exception thrown :
  javax.servlet.ServletException:
  String index out of range: -1
  
  Relevant entries from stack trace are as
  follows:
  java.lang.StringIndexOutOfBoundsException:
    String index out of range: -1
    at java.lang.StringBuffer.deleteCharAt
                   (StringBuffer.java:367)
    at com.ibm.ws.console.security.SSLConfig.
      TrustKeyManagersDetailForm.
      setTrustManagers
      (TrustKeyManagersDetailForm.java:197)
  

Problem conclusion

• Correction was made to the string manipulation code
  involved in the removal of trust managers.
  
  The fix for this APAR is currently targeted for inclusion
  in fixpack 6.1.0.13.
  Please refer to the recommended updates page for delivery
  information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• SECURITY
  

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61I PSY

     UP

• R61P PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R61Z PSY

     UP