PK83734: Can't create CMS keyfile with IHS 7.0 from 64-bit Supplemental media on z/Linux

Fixes are available

APAR status

Closed as program error.

Error description

After <ihsinst>/java/jre/lib/gskikm.jar is moved, attempts
to open or create a CMS KeyFile in ikeyman report an error
loading the native CMS library.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED: IHS 7.0 users on z/Linux that install IHS    *
* from the 64-bit Supplement CD, and use Ikeyman on the IHS    *
* system.                                                      *
****************************************************************
* PROBLEM DESCRIPTION:                                         *
* After <ihsinst>/java/jre/lib/gskikm.jar is moved, attempts   *
* to open or create a CMS KeyFile in ikeyman report an error   *
* loading the native CMS library.                              *
****************************************************************
* RECOMMENDATION: Apply this APAR if no other ikeyman          *
* implementation (32-bit Supplement CD, prior release) is      *
* available and certificate management cannot be performed on  *
* another host (due to cryptographic hardware)                 *
****************************************************************
When <ihsinst>/java/jre/lib/ext/gskikm.jar is moved, Ikeyman
uses a mix of java and native code to manipulate CMS key
databases.

On z/Linux, only 31-bit native CMS libraries are shipped with
IHS, but the JRE bundled with IHS 7.0 on z/Linux is
inadvertantly a 64-bit JRE. This 64-bit JRE is not able to
load the bundled 31-bit GSKit CMS library.

As a circmvention, restoring the gskikm.jar to its original
location causes the JRE to use a full-java implementation
of the CMS KeyFile. Unfortunately, the PKCS11 interface
in Ikeyman v8 bundled with Java 6 is very different and
requires extensive configuration.

Problem conclusion

Future fixpacks for z/Linux include both a 31-bit and a 64-bit
GSKit native library, and the IHS wrapper scripts for Ikeyman
and gsk7cmd setup the shared library path based on the
architecture of the bundled JRE.

This fix is targeted for IHS fixpacks:

 - 7.0.0.5

Temporary fix

Comments

APAR Information

APAR number
PK83734
Reported component name
IBM HTTP SERVER
Reported component ID
5724J0801
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2009-03-31
Closed date
2009-05-01
Last modified date
2009-05-01

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
IBM HTTP SERVER
Fixed component ID
5724J0801

Applicable component levels

R700 PSN
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
07 September 2022

Tips

PK83734: Can't create CMS keyfile with IHS 7.0 from 64-bit Supplemental media on z/Linux

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSN

Document Information

Share your feedback

Need support?