PH15900: EXEC CICS EXTRACT CERTIFICATE RETURNS WITH WRONG DATA

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When using:
  
   Exec Cics Extract Certificate
             Userid(CertUser)
             Owner
             CommonName(CertCommonNamePtr)
             CommonNamLen(CertCommonNameLen)
             Resp(Resp)
             Resp2(Resp2);
  
  
  we don't get back the right CommonName, instead the
  value is filled with something else.
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION: EXEC CICS EXTRACT CERTIFICATE returns   *
  *                      garbage for certificate attribute       *
  *                      fields.                                 *
  ****************************************************************
  A client certificate is passed into CICS for a connection on an
  HTTP TCPIPSERVICE which is defined with SSL(CLIENTAUTH).
  The web task which runs, issues EXEC CICS EXTRACT CERTIFICATE to
  extract various certificate attributes. The attributes returned
  are garbage. The primary cause of the problem is that the
  GSK_ATTRIBUTE_GET_CERT_INFO call which CICS makes to system SSL
  contains incorrect length fields for certain certificate
  attributes. This issue is fixed by SYSTEM SSL APAR OA58335.
  However, with the SYSTEM SSL fix applied there is a further
  problem caused by defective code in CICS module DFHSOSE which
  generates the record which is stored in the CICS certificate
  repository. The defective code uses a 31-bit pointer field
  instead of a 64-bit pointer field when processing certificate
  field attributes.
  

Problem conclusion

• DFHSOSE has been changed to use a 64-bit pointer when processing
  certificate field attributes.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI66807 UI66808

Modules/Macros

• DFHSOSE
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R100 PSY UI66807

     UP19/12/06 P F912

• R200 PSY UI66808

     UP19/12/06 P F912

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.