Certificate got deleted/replaced after executing ZWESSOTK in Zowe 1.21

[rjmaomao]

We have seen some issue after switching to use JCL ZWESSOTK to add JWT certificates to RACF. In previous version, before 1.20 I think, gskkyman is used, we only need to run script zowe-setup-certificates.sh. Now in 1.21, after executed zowe-setup-certificates.sh, we need to copy the certificate to MVS data set then ran ZWESSOTK to add it to RACF data base.

After switching to this method, we noticed every time we add a new JWT certificate, there's an existed certificates got deleted. Some times the certificate got deleted was previous added JWT, sometimes even zOSMF certificate got deleted. After some debugging, RACF dev noticed the public key of these certificates being added were the same as the existed certificates. So it's possible that existed certificate got replaced by the newly added one.

My questions is, how does the script create JWT certificate, does it use the same public key as zOSMF certificate when generating?

Thank you!

[jackjia-ibm]

@rjmaomao to make sure I understand correctly, I have few questions:

• when the certificate is deleted, is it after zowe-setup-certificates.sh is done, or it's later after ZWESSOTK jcl is executed?
• I'm trying to think of which part of the script could delete existing certificate. There is no delete certificate commands explicitly in the JCL. Could it be some configuration coincidently using same label?

Do you mind share your zowe-setup-certificates.env and log? Please feel free to email me if you don't want to post here. Thanks a lot.

@NayerNajafi FYI.

[rjmaomao]

Hi @jackjia-ibm

The certificate is deleted or I should say replaced after ran ZWESSOTK JCL. More precisely, after the RACDCERT ADD command. There's no delete command in JCL nor in script. RACF dev said if the public key of the two certificates is the same, then it's possible that the new added certificate can replace the existed one. By the way, I didn't use the same label, I used a new label every time.

I will send you the log and env file through email. Thank you for checking on this.

[jackjia-ibm]

This will be fixed in v1.27.0.