IBM Support

PH15900: EXEC CICS EXTRACT CERTIFICATE RETURNS WITH WRONG DATA

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When using:
    
     Exec Cics Extract Certificate
               Userid(CertUser)
               Owner
               CommonName(CertCommonNamePtr)
               CommonNamLen(CertCommonNameLen)
               Resp(Resp)
               Resp2(Resp2);
    
    
    we don't get back the right CommonName, instead the
    value is filled with something else.
    

Local fix

  • n/a
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: All                                          *
    ****************************************************************
    * PROBLEM DESCRIPTION: EXEC CICS EXTRACT CERTIFICATE returns   *
    *                      garbage for certificate attribute       *
    *                      fields.                                 *
    ****************************************************************
    A client certificate is passed into CICS for a connection on an
    HTTP TCPIPSERVICE which is defined with SSL(CLIENTAUTH).
    The web task which runs, issues EXEC CICS EXTRACT CERTIFICATE to
    extract various certificate attributes. The attributes returned
    are garbage. The primary cause of the problem is that the
    GSK_ATTRIBUTE_GET_CERT_INFO call which CICS makes to system SSL
    contains incorrect length fields for certain certificate
    attributes. This issue is fixed by SYSTEM SSL APAR OA58335.
    However, with the SYSTEM SSL fix applied there is a further
    problem caused by defective code in CICS module DFHSOSE which
    generates the record which is stored in the CICS certificate
    repository. The defective code uses a 31-bit pointer field
    instead of a 64-bit pointer field when processing certificate
    field attributes.
    

Problem conclusion

  • DFHSOSE has been changed to use a 64-bit pointer when processing
    certificate field attributes.
    

Temporary fix

Comments

APAR Information

  • APAR number

    PH15900

  • Reported component name

    CICS TS Z/OS V5

  • Reported component ID

    5655Y0400

  • Reported release

    000

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-08-22

  • Closed date

    2019-12-05

  • Last modified date

    2020-01-03

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    UI66807 UI66808

Modules/Macros

  • DFHSOSE
    

Fix information

  • Fixed component name

    CICS TS Z/OS V5

  • Fixed component ID

    5655Y0400

Applicable component levels

  • R100 PSY UI66807

       UP19/12/06 P F912

  • R200 PSY UI66808

       UP19/12/06 P F912

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSGMGV","label":"CICS Transaction Server"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.3","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}},{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.3","Edition":"","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
03 January 2020