PK89438: WEBSPHERE APPLICATION SERVER 7: GLOBAL SECURITY CUSTOM PROPERTY COM.IBM.SSL.ROOTCERTSUBJECTDN DOES NOT WORK

Fixes are available

APAR status

Closed as program error.

Error description

On WebSphere Application Server 7, the following steps does
not result in new rootcertificate's subject to have modified
values:

NOTE: I referred to the following infocenter page to do this -
http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?
topic=/c
om.ibm.websphere.nd.doc/info/ae/ae/csec_7ssldefault_chainedcert_
config.html

1. Create new Global Security custom property as the one below:
com.ibm.ssl.rootCertSubjectDN=cn=localhost,ou=Root Certificate,
ou=myhostNode01,
ou=myhostNode01Cell,o=MyCompany,c=US

2. Delete all *.p12 files in the environment

3. Restarted dmgr

I expected root certificate to have the subject as -
cn=localhost,
ou=Root Certificate, ou=myhostNode01, ou=myhostNode01Cell,
o=MyCompany,
c=US
it instead had default values with like o=IBM, c=US.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server who want to customize                *
*                  root certificates and update chained        *
*                  certificates with it.                       *
****************************************************************
* PROBLEM DESCRIPTION: Custom property value for               *
*                      com.ibm.ssl.rootCertSubjectDN           *
*                      was not picked up to customize the      *
*                      root certificate.                       *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
Custom property value for
property com.ibm.ssl.rootCertSubjectDN was not properly passed
to the root certificate recreation.

Problem conclusion

Code is updated to honor the custom property:
com.ibm.ssl.rootCertSubjectDN. Also InfoCenter is updated by
PK94454 to clarify the steps to usage of custom property.

The fix for this APAR is currently targeted for inclusion in
fix pack 7.0.0.9.  Please refer to the Recommended
Updates
page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Manual steps to perform root certificate customization and
have the new root certificate change reflected in chained
certificates.

#1. First create a new root certificate:
  a.  Go to SSL certificate and key management > Key stores
and ertificates
  b. In the pulldown list in the box marked
"Keystore usages" select "Root certificate keystore"
  c. click on the DmgrDefaultRootStore  or
NodeDefaultRootStore depending on what type of server you have
installed.
  d. click Personal Certificates then Create -
Self-signed Certificate

#2. Replace the old root certificate with the new one:
  a. From the panel with the list of root certificate you
should see the old one and the newly created one.
  b. Select the old root certificate.  Then click "Replace"
  c. On the replace panel select the new certificate alias
from the box called "Replace with"
  d.    Click both box called "Delete old certificate after
replacement"
  e.    Click the box called "Delete old signers"

#3.  After that go to each of the chained certificates in the
configuration you want replace with a cert with the new root
certificate by selecting that certificate from the personal
certificate collection then clicking "Renew"

Comments

APAR Information

APAR number
PK89438
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-06-20
Closed date
2009-09-17
Last modified date
2009-09-17

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R700 PSY
UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 October 2021

Tips

PK89438: WEBSPHERE APPLICATION SERVER 7: GLOBAL SECURITY CUSTOM PROPERTY COM.IBM.SSL.ROOTCERTSUBJECTDN DOES NOT WORK

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

Document Information

Share your feedback

Need support?