IBM i Global

Dear Scott

Please read the latter part of this Technote on how to handle your situation:  How to Change the Password to the *System Store in Digital Certificate Manager for i (DCM) at https://www.ibm.com/support/pages/how-change-password-system-store-digital-certificate-manager-i-dcm     

Thanks Satid.  However, it isn’t the certificate store password that is being rejected. 

The message I’m referring to appears on the DCM login page when trying to log in with QSECOFR or the other profile.

Scott

Here's a bit of information that might help resolve the access to DCM.

There are multiple TLS enablements for DCM.  It was mentioned that TLS to ADMIN3 was not being used since you are able to access the login screen using port 2006.
But another connection could be trying to use TLS which is the ADMIN3 Liberty Server to the Host-Servers across the loopback address using secure ports for login, remote command, and file server.  Here's a link to the IBM i documentation and a snippet of the steps that describe the secure host-server connections and how to resolve issues if unable to login.

Support for Multi-Factor Authentication (MFA) and Transport Layer Security (TLS) - IBM Documentation

These steps are provided to help diagnose and resolve configuration issues that are causing IBM Digital Certificate Manager for i from establishing a secure TLS session to host servers. Since DCM cannot be used with TLS enabled, it must be disabled to resolve the configuration issue.

1. Disable host server TLS for DCM. There are two methods available to disable TLS connections to host servers.
   2. Manually modify the dcm.properties configuration file.
      • EDTF '/QIBM/UserData/ICSS/dcm.properties'
      • Set tlsEnabled=false
      • Save and exit the editing session.
2. Restart the Admin3 server.
   • ENDTCPSVR SERVER(*IAS) INSTANCE(ADMIN3)
   • STRTCPSVR SERVER(*IAS) INSTANCE(ADMIN3)
3. Use IBM Digital Certificate Manager for i to verify the correct certificate is assigned to the host server applications and use Validate to ensure the certificate is acceptable for TLS communications.

SOLUTION:

Move these files out of /QOpenSys/QIBM/ProdData/JavaVM/jdk80/64bit/jre/lib/security directory

US_export_policy.jar
local_policy.jar

Then restarted the HTTP ADMIN server.

Once those old policy.jar files were moved out of that directory, accessing DCM worked again.

---------------------------------------------------------------------------------------------------------------------------------------

THE WHOLE PROCESS THAT IBM HAD ME WORK THROUGH (may be TL;DR):

I worked with IBM Support yesterday and got this problem resolved.  I used the QMGTOOLS HTTPMNU #2 HTTPAdmin Collector and provided IBM with the /tmp/collectorscripts/data/httpAdmincollector.zip it created. From that information:

1. They found that the QWEBADMIN user profile was disabled so they had me enable it. 
2. They also had me do a CHGAUT OBJ('/QIBM/ProdData/OS400/jt400/lib/java8/') USER(*PUBLIC) DTAAUT(*RX) command.

However, both those actions didn't solve the problem (at least initially - they might have factored into the solution after the next issue was found and addressed.

Next I was asked to run these two commands in QSH:

1. > cd /qibm/userdata/httpa/admin/logs/collectorfiles/HEALTHCHECK
2. > /QIBM/ProdData/OS/OSGi/healthcheck/bin/arefix.sh -report ADMINhcReport.xml -silent

This output was produced:

JAVA_HOME set to /QOpenSys/QIBM/ProdData/JavaVM/jdk80/32bit
The java.version property was detected as input. This property is used as output only and has no effect on JVM initialization.
IBM Administration Runtime Expert for i
Version 1.6.24
Wed Apr 08 14:59:48 CDT 2026
Searching for elements
Number of runtime elements: 26
Running plugin Auto-Fix Plugin
A total of 6 fix actions were successfully processed
IBM Administration Runtime Expert for i
Version 1.6.24
Wed Apr 08 14:59:48 CDT 2026
Number of runtime elements: 26
Host name: ************
System name: ************
Release: V7R4
Machine type: ************
Machine model: ************
Serial number: ************
PTF group status:
SF99652 - 9 INSTALLED CONTENT MANAGER ONDEMAND FOR I - 5770-RD1 7.4
SF99652 - 24 INSTALLED CONTENT MANAGER ONDEMAND FOR I - 5770-RD1 7.4
SF99653 - 9 RELATED_GROUP DB2 WEB QUERY FOR I V2.2.1
SF99653 - 12 RELATED_GROUP DB2 WEB QUERY FOR I V2.2.1
SF99654 - 4 RELATED_GROUP DB2 WEB QUERY FOR I V2.3.0
SF99654 - 9 INSTALLED DB2 WEB QUERY FOR I V2.3.0
SF99661 - 8 INSTALLED WEBSPHERE APP SERVER V8.5
SF99661 - 10 INSTALLED WEBSPHERE APP SERVER V8.5
SF99662 - 18 INSTALLED IBM HTTP SERVER FOR I
SF99662 - 49 INSTALLED IBM HTTP SERVER FOR I
SF99663 - 9 INSTALLED PERFORMANCE TOOLS
SF99663 - 18 INSTALLED PERFORMANCE TOOLS
SF99664 - 29 INSTALLED BACKUP RECOVERY SOLUTIONS
SF99664 - 49 INSTALLED BACKUP RECOVERY SOLUTIONS
SF99665 - 13 INSTALLED JAVA
SF99665 - 31 INSTALLED JAVA
SF99666 - 8 INSTALLED HIGH AVAILABILITY FOR IBM I
SF99666 - 22 INSTALLED HIGH AVAILABILITY FOR IBM I
SF99667 - 5 INSTALLED 740 TCP/IP PTF
SF99667 - 13 INSTALLED 740 TCP/IP PTF
SF99668 - 18 INSTALLED IBM DB2 MIRROR FOR I
SF99668 - 28 INSTALLED IBM DB2 MIRROR FOR I
SF99672 - 4 INSTALLED DB2 WEB QUERY FOR I V2.4.0
SF99675 - 1 INSTALLED HARDWARE AND RELATED PTFS
SF99675 - 2 INSTALLED HARDWARE AND RELATED PTFS
SF99704 - 19 INSTALLED DB2 FOR IBM I
SF99704 - 32 INSTALLED DB2 FOR IBM I
SF99737 - 5 INSTALLED TECHNOLOGY REFRESH
SF99737 - 12 INSTALLED TECHNOLOGY REFRESH
SF99738 - 29 INSTALLED GROUP SECURITY
SF99738 - 87 INSTALLED GROUP SECURITY
SF99739 - 73 INSTALLED GROUP HIPER
SF99739 - 165 INSTALLED GROUP HIPER
SF99740 - 21238 INSTALLED CUMULATIVE PTF PACKAGE C1238740
SF99740 - 25303 INSTALLED CUMULATIVE PTF PACKAGE C5303740
SF99741 - 8 INSTALLED ALL PTF GROUPS EXCEPT CUMULATIVE PTF PACKAGE & MQ
SF99741 - 11 INSTALLED ALL PTF GROUPS EXCEPT CUMULATIVE PTF PACKAGE & MQ
Running plugin Auto-Fix Plugin
> A total of 1 XML rule file will be processed
> Processing XML rule file (ADMINhcReport.xml) for Auto-Fix Plugin
o There are a total of 6 fix actions found in 2 categories.
> Performing fix action: DataAuthority - areFixAction2
- Changing user *PUBLIC data authority to /QIBM/UserData/HTTPA
- Changing data authority from '*RWX' to '*RX'
o Fix complete
> Performing fix action: DataAuthority - areFixAction3
- Changing user *PUBLIC data authority to /QIBM/UserData/HTTPA/admin
- Changing data authority from '*RWX' to '*RX'
o Fix complete
> Performing fix action: DataAuthority - areFixAction4
- Changing user *PUBLIC data authority to /QIBM/UserData/HTTPA/admin/webapps
- Changing data authority from '*RWX' to '*RX'
o Fix complete
> Performing fix action: DataAuthority - areFixAction5
- Changing user *PUBLIC data authority to /QIBM/UserData/HTTPA/admin/www
- Changing data authority from '*RWX' to '*RX'
o Fix complete
> Performing fix action: UserProfile - areFixAction0
- Changing field STATUS of user profile QWEBADMIN from '*DISABLED' to '*ENABLED'
o Fix complete
> Performing fix action: UserProfile - areFixAction1
- Changing field OUTQ of user profile QTMHHTTP from '/QSYS.LIB/QUSRSYS.LIB/GARBAGE.OUTQ' to '*WRKSTN'
o Fix complete
> A total of 6 fix actions were successfully processed
> Finished processing Auto-Fix Plugin
> Total number of Auto-Fix Plugin items checked: 6
Result of running: true
$

Next I was asked to run this command in QSH and look for certain policy.jar files:

ls -l /QOpenSys/QIBM/ProdData/JavaVM/jdk80/64bit/jre/lib/security

If you see a local_policy.jar and/or a US_export_policy.jar we would want to move these out of the above directory.

Then restart admin and see if that resolves the issue.

IT DID RESOLVE THE ISSUE!

***END***

Please try clearing browser history and cache