IBM Crypto Education Community

IBM Crypto Education Community

IBM Crypto Education Community

Join the IBM Crypto Education community to explore and understand IBM cryptography technology. This community is operated and maintained by the IBM Crypto Development team.

 View Only
  • 1.  Hardware error from call CSNDDSV returnCode 12 reasonCode 11060

    Posted Fri October 27, 2023 06:23 AM

     i tried to allocate a new ds (seq or pds), using the z/OSMF swagger document at xxx.xxx.xxx.xxx:443/zosmf/api/explorer/#!/Dataset_APIs/CreateDataSet and it runs fine, but when i try the same in a sample workflow (github.com/openmainframeproject/zorow/blob/master/zOSMF-Samples/workflow_sample_dataset.xml) , it fails miserably with : IZUWF9999E: The request cannot be completed because an error occurred. The following error data is returned: "com.ibm.crypto.hdwrCCA.provider.JCECCARuntimeException: Hardware error from call CSNDDSV returnCode 12 reasonCode 11060" . I have no clue about this error. This works OK on an other 2.3 platform. The java version used by z/OSMF is /usr/lpp/java/J8.0_64...The message seems to indicate that java in z/OSMF is trying to use a hardware provider (crypto expres ??). I wonder if that could be due to the certificates (both self signed CA and z/SOMF certs being expired). This system has no crypto exprerss card, and ICSF is not started. Thansk for any sugestion or insight



    ------------------------------
    philippe richard
    ------------------------------


  • 2.  RE: Hardware error from call CSNDDSV returnCode 12 reasonCode 11060

    Posted Fri October 27, 2023 11:01 AM

    12/11060 is documented in the ICSF Application Programmer's Guide.

    The service could not be performed because the required coprocessor was not active or did not have a master
    key set, or the coprocessor did not have the required firmware update.

    This return and reason code tells me that ICSF is running on the system but that no coprocessors are available to handle the request. I see that you are going through JCECCA which implies that the caller thinks ICSF should be up and fully capable. This sounds like a question for z/OSMF to understand why it's trying to use a hardware provider.



    ------------------------------
    Eric Rossman
    ------------------------------



  • 3.  RE: Hardware error from call CSNDDSV returnCode 12 reasonCode 11060

    Posted Fri October 27, 2023 11:21 AM
    Thank you Eric for your answer. What puzzles me is that both requests go
    through the same channel, i.e z/OSMF, one using the workflow interface,
    the other one using the z/OSMF swagger API interface...

    i don't understand why one would work (swagger REST API), and not the
    other (workflow). In boyh cases we are using the z/OSMF liberty server,
    so the same java environment (options, properties,...).

    Let me correct a mistake, ICSF is actually running on that system, but
    with no crypto engines (only CPACF)

    CSFM654I KEY ARCHIVING USE CONTROL IS DISABLED.
    CSFM653I TKDS LOADED 3 RECORDS WITH AVERAGE SIZE 493
    CSFM015I FIPS 140 SELF CHECKS FOR PKCS11 SERVICES SUCCESSFUL.
    CSFM505I CRYPTOGRAPHY - THERE ARE NO ACTIVE CRYPTOGRAPHIC COPROCESSORS.
    CSFM133I THERE ARE NO ACTIVE PKCS11 COPROCESSORS.
    CSFM507I CRYPTOGRAPHY - THERE ARE NO CRYPTOGRAPHIC COPROCESSORS ONLINE.
    CSFM508I CRYPTOGRAPHY - THERE ARE NO CRYPTOGRAPHIC ACCELERATORS ONLINE.
    CSFM126I CRYPTOGRAPHY - FULL CPU-BASED SERVICES ARE AVAILABLE.
    CSFM001I ICSF INITIALIZATION COMPLETE
    CSFM640I ICSF RELEASE FMID=HCR77D1.




  • 4.  RE: Hardware error from call CSNDDSV returnCode 12 reasonCode 11060

    Posted Tue November 07, 2023 09:25 AM

    The issue is solved.

    The JCECCA issue was fixed. "identified that previous maintenance on zOSMF overrode the location of the jvm.options property for security overrides, trashing the set-up we have in place to ignore hardware crypto services from ICSF. .. re-applied the  override to the default and java ssl negotiation is working again"



    ------------------------------
    Philippe RICHARD
    ------------------------------