IBM Support

ARC1582I Certificate validation error during a migrate to ML1/ML2 from a non-cloud enabled HSM instance within an HSMplex

Troubleshooting


Problem

If a data set was previously migrated to and then recalled from CLOUD within an HSMplex, then a subsequent migration of the data set to ML1 or ML2 on a non-cloud enabled system within that HSMplex will issue an ARC1582I Certificate validation error during the migration process.

Symptom

ARC1582I UNEXPECTED RETURN CODE X'00000106' FROM SERVICE HWTHCONN WITH
ARC1582I (CONT.) RSN=X'00160001' SVC=X'00000008' AND ERRTEXT=Certificate
ARC1582I (CONT.) validation error

Cause

If the clouddays parameter in the SETSYS MIGRATIONCLEANUPDAYS(x y z clouddays) command is set to 0, then a subsequent migration of a data set will cause the previous cloud migration copy to be deleted in addition to the new migration copy being created. 
If this subsequent migration is done on by an HSM instance that is not cloud enabled, an ARC1582I Certificate validation error occurs when trying to scratch the old migration copy in the cloud.
The ARC1582I message does not affect the migration process, but the failure to scratch the old migration copy results in that old migration copy becoming orphaned in the cloud.
Note: 
If the retained MCA support is being utilized (i.e. specifying a value greater than 0 for the clouddays in the SETSYS MIGRATIONCLEAUPDAYS(x y z clouddays) command), then HSM will expire the old cloud migration copies after the specified days during secondary space management on an HSM instance that is cloud enabled. Therefore, with the retained MCA support, the ARC1582I error should not occur during the subsequent migration in this scenario.

Environment

This scenario can only occur in an environment where the retained MCA support is not used (i.e. SETSYS MIGRATIONCLEANUPDAYS(x y z 0)) and there are multiple HSM instances within the same HSMplex where some HSM instances are cloud-enabled while other HSM instances are not.

Resolving The Problem

The ARC1582I message does not affect the migration process, but the failure to scratch the old migration copy results in that old migration copy becoming orphaned in the cloud. There are two options to clean up the orphaned migration copy in the cloud:
  1. Run an AUDIT MEDIACONTROLS(CLOUD(cloudname)) NOFIX ODS('some_output_dsn') command and review the errors reported by HSM in the output and the reported orphaned migration copies in the cloud. A subsequent AUDIT run with the FIX parameter should delete the orphaned migration copies.
  2. Utilize the retained MCA support by specifying a clouddays value greater than zero in the SETSYS MIGRATIONCLEANUPDAYS(x y z clouddays) command. An execution of secondary space management on an HSM that is cloud-enabled should clean up the old cloud migration copies after the specified clouddays has elapsed.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB56","label":"Z HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG90","label":"z\/OS"},"ARM Category":[{"code":"a8m0z0000000AHoAAM","label":"DFSMS-\u003EHSM-\u003EMigration"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"2.3.0;2.4.0;2.5.0;3.1.0;3.2.0"}]

Document Information

Modified date:
13 June 2025

UID

ibm17236514