OA56738: ABEND306 RSN40 ICH440I ICH444I WHEN STARTING GSKSRVR GSKSSL GSKCMS31 GSKSSL64 GSKCMS64

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• EXTERNAL SYMPTOMS:
  After an IPL or restart of GSKSRVR or an application that uses
  System SSL, a program signature error occurs. The following
  messages may be seen:
  
  ICH440I Program signature error 0x10/0x00000024 for program
          GSKSSL in library SYS1.SIEALNKE. The program was not
          loaded.
  
  ICH444I The program contains an incorrect certificate chain.
          Reason code X'24'.
  
  CEE3596S An MVS load of module GSKCMS31 failed. The system
  abend code was 00000306; the reason code was 00000040.
  
  
  GLD1064E Unable to load the System SSL runtime: 207/C40B000A -
           EDC5207S Load request for DLL load module unsuccessful.
  
  SYSTEM COMPLETION CODE=306  REASON CODE=00000040
  
  IMPACT:
  FIPS enabled System SSL applications attempting to load System
  SSL DLLs will not start.
  
  ANALYSIS:
  The IBM-supplied certificate used in z/OS 2.1 System SSL module
  signature verification has expired.
  
  VERIFICATION STEPS:
  1)  Verify system is running z/OS 2.1.
  2)  Run the following RACF command to obtain code
      signature verification keyring name:
        RLIST FACILITY IRR.PROGRAM.SIGNATURE.VERIFICATION
  2a) If no profile is found,
      ie: IRR.PROGRAM.SIGNATURE.VERIFICATION NOT FOUND
      then System SSL modules are not FIPS enabled;
      therefore, this APAR is not applicable.
  
  ADDITIONAL KEYWORDS FOR SEARCHABILITY:
  V2R1 MSGICH440I MSGICH444I ABENDS306
  

Local fix

• LOCAL FIX OR CIRCUMVENTION:
  Refrain from IPLing system, restarting any FIPS-enabled
  application, or using GSKKYMAN against a FIPS-enabled KDB until
  PTF is applied.
  
  ++APARs are available upon request.
  
  RECOVERY:
  Refer to RACF Security Administrator Response section of ICH444I
  documentation in z/OS Security Server RACF Messages and Codes.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: z/OS V2R1 System SSL installation with       *
  *                 module (program) signature verification      *
  *                 enabled                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: When module (program) signature         *
  *                      verification is enabled for the System  *
  *                      SSL modules and either the GSKSRVR      *
  *                      started task, gskkyman or a System SSL  *
  *                      application is started (or restarted),  *
  *                      the load of the System SSL modules may  *
  *                      result in an ABEND 306 due to the IBM   *
  *                      z/OS System SSL signing certificate     *
  *                      being expired.  The following           *
  *                      accompanying messages may also be       *
  *                      presented:                              *
  *                                                              *
  *                      ICH440I Program signature error         *
  *                              0x10/0x00000024 for program     *
  *                              GSKxxx in library SYS1.SIEALNKE *
  *                              The program was not loaded.     *
  *                                                              *
  *                          GSKxxx can be one of the following: *
  *                              GSKSSL                          *
  *                              GSKSSL64                        *
  *                              GSKS31F                         *
  *                              GSKS64F                         *
  *                              GSKCMS31                        *
  *                              GSKCMS64                        *
  *                              GSKC31F                         *
  *                              GSKC64F                         *
  *                              GSKSRVR                         *
  *                              GSKKYMAN                        *
  *                              GSKSRBRD                        *
  *                              GSKSRBWT                        *
  *                                                              *
  *                      ICH444I The program contains an         *
  *                              incorrect certificate chain.    *
  *                              Reason code X'24'.              *
  *                                                              *
  *                      Reason code x'24' in this case          *
  *                      indicates the certificate used to sign  *
  *                      the module has expired.                 *
  ****************************************************************
  * RECOMMENDATION: APPLY PTF                                    *
  ****************************************************************
  System SSL modules GSKSSL, GSKSSL64, GSKS31F, GSKS64F, GSKCMS31,
  GSKCMS64, GSKC31F, GSKC64F, GSKSRVR, GSKKYMAN, GSKSRBRD and
  GSKSRBWT are digitally signed during the build process for
  System SSL by an IBM certificate. If module (program) signature
  verification has been enabled for the System SSL modules and
  one of the modules requiring verification is loaded into
  storage, verification will fail due to the signing IBM
  certificate being expired.
  
  For information about System SSL module verification,
  see "System SSL module verification setup" section in the
  z/OS System SSL publication (SC14-7495).
  
  For FIPS 140-2, System SSL signs all modules which can be
  used in FIPS mode.  All signed modules except for GSKC31F,
  GSKC64F, GSKS31F and GSKS64F are used in both FIPS and
  non-FIPS mode.  When module signature verification is enabled,
  any of the stated modules when used will be verified whether
  being used in FIPS or non-FIPS mode.
  

Problem conclusion

• An updated IBM System SSL certificate is being used to sign
  the modules.
  

Temporary fix

• *********
  * HIPER *
  *********
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UA98368 UA98369

Modules/Macros

• GSKCMS31 GSKCMS64 GSKC31F  GSKC64F  GSKKYMAN GSKSRBRD GSKSRVR
  GSKSSL   GSKSSL64 GSKS31F  GSKS64F
  

Fix information

• Fixed component name

  SYSTEM SSL

• Fixed component ID

  565506805

Applicable component levels

• R410 PSY UA98368

     UP19/01/24 P F901 ¢

• R411 PSY UA98369

     UP19/01/25 P F901 ¢

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.