IBM Support

twsinst fails with migrating certification to p12 error

Troubleshooting


Problem

The MDM upgrade from 10.1.6 to 10.2.5 failed when twsinst running to migrate TWSClientKeyStoreJKS.jks to p12 with error "Keystore was tampered with, or password was incorrect".

Symptom

twsinst log shows:

/opt/wa/TWS/_uninstall/ACTIONTOOLS/updateLWAAction.sh migrateToP12: running keytool commands SECUREWRAP_CMDPATH = /opt/wa/TWS/JavaExt/jre/jre/bin

Importing keystore /opt/wa/TWSDATA/ssl/TWSClientKeyStoreJKS.jks to /opt/wa/TWSDATA/ssl/certs/TWSClientTrustStore.p12...

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

ERROR rc 1 from /opt/wa/TWS/_uninstall/ACTIONTOOLS/updateLWAAction.sh migrateToP12 Error in /opt/wa/TWS/bin/securewrap -cmd jks -args -importkeystore -srckeystore /opt/wa/TWSDATA/ssl/TWSClientKeyStoreJKS.jks -destkeystore /opt/wa/TWSDATA/ssl/certs/TWSClientTrustStore.p12 -deststoretype PKCS12 -noprompt -srcstorepass xxxxx -deststorepass xxxxx -destkeypass xxxxx

Cause

The certification password had been changed before using:

/opt/wa/TWS/bin/secure -password default -base64 e -out TWSClientKeyStoreJKS.sth

 

Using -base64 only encodes the password; it does not encrypt it, meaning it remains readable and insecure.

Diagnosing The Problem

1.generate <password> password with aes encryption

/opt/wa/TWS/bin/secure -password default

{aes}XXXXXXXXXXXXXXXXXXXXXX

 

2.try it to list certificates upload by the costumer

export SECUREWRAP_CMDPATH=/opt/wa/TWS/JavaExt/jre/jre/bin

/opt/wa/TWS/bin/securewrap -cmd jks -args "-list -keystore /wa-server/TWSClientKeyStoreJKS.jks -storepass {aes}XXXXXXXXXXXXXXXXXXXXXX -storetype PKCS12"

 

3.succ, the certificates use <password> password

Keystore type: PKCS12

Keystore provider: SUN

Your keystore contains 4 entries

intermediate, Mar 20, 2025, trustedCertEntry,

Certificate fingerprint (SHA-256): XXXXXXXXXXXXXXXXXXXXXX

rootca, Mar 20, 2025, trustedCertEntry,

Certificate fingerprint (SHA-256): XXXXXXXXXXXXXXXXXXXXXX

uatda, Dec 3, 2025, PrivateKeyEntry,

Certificate fingerprint (SHA-256): XXXXXXXXXXXXXXXXXXXXXX

uattws, Mar 20, 2025, trustedCertEntry,

Certificate fingerprint (SHA-256): XXXXXXXXXXXXXXXXXXXXXX

 

4.get the aes password from TWSClientKeyStoreJKS.sth, the one use by the script and try to list certificates

export SECUREWRAP_CMDPATH=/opt/wa/TWS/JavaExt/jre/jre/bin

/opt/wa/TWS/bin/securewrap -cmd jks -args "-list -keystore /wa-server/TWSClientKeyStoreJKS.jks -storepass {aes}YYYYYYYYYYYYYYYYYYYYYYYYYY -storetype PKCS12"

 

5.error

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

Resolving The Problem

Recreate the TWSClientKeyStoreJKS.sth file with the correct password encrypted:

Backup and delete the current TWSClientKeyStoreJKS.sth file;
Generate a new encrypted file using the standard command:
/opt/wa/TWS/bin/secure -password <password> -out TWSClientKeyStoreJKS.sth

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSGSPN","label":"IBM Workload Scheduler"},"ARM Category":[{"code":"a8m50000000L35bAAC","label":"Security-\u003ECertificates"}],"ARM Case Number":"TS020886143","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.2.5"}]

Document Information

Modified date:
20 January 2026

UID

ibm17257434

Page Feedback