IJ59137: PKCS12 AND CMS KEYSTORES PASSWORD CHANGE FAILS IN WEBSPHERE (TRADITIONAL) WITH IBMJCECCA AS THE FIRST SECURITY PROVIDER

APAR status

• Closed as program error.

Error description

• Error Message: If a user tries to change a PKCS12 or CMS
  keystore using administrative functions in WebSphere
  (traditional) with IBMJCECCA as the first security provider,
  then the user may encounter the "Private key is not encoded as
  PKCS#8" error for PKCS12 and "java.io.IOException:
  PrivateKeyInfo parsing error." error for CMS keystore.
  .
  Stack Trace:
  --- PKCS12 Error ---
  
  com.ibm.websphere.management.cmdframework.CommandException:
  Private key is not encodedas PKCS#8
  at com.ibm.ws.ssl.commands.keyStores.ChangeMultipleKeyStorePass
  words.beforeStepsExecuted(ChangeMultipleKeyStorePasswords.java:
  152)
  at com.ibm.websphere.management.cmdframework.provider.AbstractT
  askCommand.executeReal(AbstractTaskCommand.java:835)
  
  at
  com.ibm.websphere.management.cmdframework.provider.AbstractTask
  Command.execute(AbstractTaskCommand.java:807)
  
  at
  com.ibm.ws.management.cmdframework.impl.RemoteCommandMgrImpl.ex
  ecute(RemoteCommandMgrImpl.java:370)
  
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at
  sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccesso
  rImpl.java:90)
  
  at
  sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMetho
  dAccessorImpl.java:55)
  
  at java.lang.reflect.Method.invoke(Method.java:508)
  
  at sun.reflect.misc.Trampoline.invoke(MethodUtil.java:83)
  
  atsun.reflect.GeneratedMethodAccessor60.invoke(Unknown Source)
  ...
  Caused by: com.ibm.websphere.crypto.KeyException: Private key is
  
  
  
  not encodedas PKCS#8
  at com.ibm.ws.ssl.config.WSKeyStore.invokeKeyStoreCommand(WSKey
  Store.java:2313)
  
  at
  com.ibm.ws.ssl.config.WSKeyStoreRemotable.invokeKeyStoreCommand
  (WSKeyStoreRemotable.java:275)
  
  at
  com.ibm.ws.ssl.commands.keyStores.KeyStoreHelper.changePassword
  PKCS12(KeyStoreHelper.java:983)
  
  at
  com.ibm.ws.ssl.commands.keyStores.ChangeMultipleKeyStorePasswor
  ds.changeKSPasswords(ChangeMultipleKeyStorePasswords.java:196)
  at
  com.ibm.ws.ssl.commands.keyStores.ChangeMultipleKeyStorePasswor
  ds.beforeStepsExecuted(ChangeMultipleKeyStorePasswords.java:146)
  
  
  
  Caused by: java.security.KeyStoreException: Private key is not
  encodedas PKCS#8
  at com.ibm.crypto.provider.PKCS12KeyStoreOracle.engineSetKeyEnt
  ry(PKCS12KeyStoreOracle.java:1046)
  
  at java.security.KeyStore.setKeyEntry(KeyStore.java:1155)
  
  at
  com.ibm.ws.ssl.config.WSKeyStore.invokeKeyStoreCommand(WSKeySto
  re.java:1776)   ... 29 more
  Caused by: java.security.KeyStoreException: Private key is not
  encoded as PKCS#8
  at com.ibm.crypto.provider.PKCS12KeyStoreOracle.a(PKCS12KeySto
  reOracle.java:1030)
  
  at
  com.ibm.crypto.provider.PKCS12KeyStoreOracle.engineSetKeyEntry(
  PKCS12KeyStoreOracle.java:348)  ... 31 more
  Caused by: java.security.KeyStoreException: Private key is not
  encodedas PKCS#8
  at
  com.ibm.crypto.provider.PKCS12KeyStoreOracle.a(PKCS12KeyStoreOr
  acle.java:802)   ... 32 more
  
  --- CMS Error ---
  
  com.ibm.websphere.management.cmdframework.CommandException
  java.lang.Exception: java.lang.Exception: PrivateKeyInfo parsing
  
  error.   at
  com.ibm.security.cmskeystore.CMSKeyStoreSpi.engineStore(C
  MSKeyStoreSpi.java)   at
  java.security.KeyStore.store(KeyStore.java)
  .
  

Local fix

• Remove IBMJCECCA from the provider list to change PKCS12 and CMS
  
  
  
  
  keystore password in WebSphere (traditional)
  

Problem summary

• If a user tries to change a PKCS12 or CMS keystore using
  administrative functions in WebSphere (traditional) with
  IBMJCECCA as the first security provider, then the user may
  encounter the "Private key is not encoded as PKCS#8 error
  for PKCS12" and "java.io.IOException: PrivateKeyInfo parsing
  error." error for CMS keystore.
  

Problem conclusion

• The PKCS12 and CMS keystore providers were adjusted to use a
  proper security provider to load PKCS12 and CMS keystores
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
  IBM SDK, Java Technology Edition
    8    SR8 FP70  (8.0.8.70)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
   - IBM Semeru Runtimes, Version 11 and later
     https://www.ibm.com/semeru-runtimes/downloads/
   - IBM SDK, Java Technology Edition, Version 8
     https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
   - Java SDK Products on z/OS
     https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels