Cloud pak foundational services generates PKCS12 at container startup using openssl pkcs12 -export and imports them into the Liberty keystore via keytool -importkeystore; on FIPS-enabled OCP clusters with OpenSSL 3.x, the generated .p12 files use PBMAC1 as the integrity MAC by default (OID 1.2.840.113549.1.5.14), which keytool in IBM Semeru 21.0.12 now strictly rejects with NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available — this worked silently in IBM Semeru 21.0.11
Non-Working case: Java "21.0.12"
sh-5.2$ cat /proc/sys/crypto/fips_enabled
1
sh-5.2$ openssl -version
OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)
sh-5.2$ java -version
openjdk version "21.0.12" 2026-07-21 LTS
IBM Semeru Runtime Open Edition 21.0.12.0 (build 21.0.12+8-LTS)
Eclipse OpenJ9 VM 21.0.12.0 (build 21.0.12+8-openj9-0.60.0, JRE 21 Linux amd64-64-Bit Compressed References 20260721_853 (JIT enabled, AOT enabled)
OpenJ9 - 396c827fb3
OMR - 2e3166f7a
JCL - 4a6e2c21da3 based on jdk-21.0.12+8)
sh-5.2$ server version
WebSphere Application Server 26.0.0.7 (1.0.115.cl260720260702-0043) on Eclipse OpenJ9 VM, version 21.0.12+8-LTS (en_US)
sh-5.2$
Logs:
Importing keystore /opt/ibm/auth-service/certs/generated/platformauth-ks.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/key.jks...
keytool error: java.io.IOException: Integrity check failed: java.security.NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available
Key of default added to keystore.
Importing keystore /opt/ibm/auth-service/certs/generated/platformauth-ks.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/key.jks...
keytool error: java.io.IOException: Integrity check failed: java.security.NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available
Key of https://127.0.0.1:443/idauth/oidc/endpoint/OP added to keystore.
Importing keystore /opt/ibm/auth-service/certs/generated/SQLClientKeyCert.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/SQLClientKey.jks...
keytool error: java.io.IOException: Integrity check failed: java.security.NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available
[ 2026-08-15_14-55-14 ] Configuring JVM settings for liberty...
[ 2026-08-15_14-55-14 ] Successfully configured JVM settings for liberty.
Importing keystore /opt/ibm/auth-service/certs/generated/platformauth-ks.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/key.jks...
keytool error: java.io.IOException: Integrity check failed: java.security.NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available
Key of default added to keystore.
Importing keystore /opt/ibm/auth-service/certs/generated/platformauth-ks.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/key.jks...
keytool error: java.io.IOException: Integrity check failed: java.security.NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available
Key of https://127.0.0.1:443/idauth/oidc/endpoint/OP added to keystore.
Found saml.p12, removing it.
Creating saml.p12
Importing saml.p12 into saml.jks.
Importing keystore /config/resources/security/saml.p12 to /config/resources/security/saml.jks...
Working case: Java "21.0.11"
sh-5.1$ cat /proc/sys/crypto/fips_enabled
1
sh-5.1$ openssl -version
OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)
sh-5.1$
sh-5.1$ java -version
openjdk version "21.0.11" 2026-04-21 LTS
IBM Semeru Runtime Open Edition 21.0.11.0 (build 21.0.11+10-LTS)
Eclipse OpenJ9 VM 21.0.11.0 (build 21.0.11+10-openj9-0.59.0, JRE 21 Linux amd64-64-Bit Compressed References 20260421_786 (JIT enabled, AOT enabled)
OpenJ9 - c53b6b93f4
OMR - 6426f03fa
JCL - 4c4f297fe6e based on jdk-21.0.11+10)
sh-5.1$ server version
WebSphere Application Server 26.0.0.5 (1.0.113.cl260520260430-1602) on Eclipse OpenJ9 VM, version 21.0.11+10-LTS (en_US)
sh-5.1$
Logs:
Importing keystore /opt/ibm/auth-service/certs/generated/platformauth-ks.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/key.jks...
Key of default added to keystore.
Importing keystore /opt/ibm/auth-service/certs/generated/platformauth-ks.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/key.jks...
Key of https://127.0.0.1:443/idauth/oidc/endpoint/OP added to keystore.
Importing keystore /opt/ibm/auth-service/certs/generated/SQLClientKeyCert.p12 to /opt/ibm/wlp/output/defaultServer/resources/security/SQLClientKey.jks...
[ 2026-08-15_15-31-09 ] Configuring JVM settings for liberty...
[ 2026-08-15_15-31-09 ] Successfully configured JVM settings for liberty.
Key of default already found in keystore, skipping it.
Key of https://127.0.0.1:443/idauth/oidc/endpoint/OP already found in keystore, skipping it.
Creating saml.p12
Importing saml.p12 into saml.jks.
Importing keystore /config/resources/security/saml.p12 to /config/resources/security/saml.jks...
Entry for alias saml successfully imported.
Cloud pak foundational services generates PKCS12 at container startup using
openssl pkcs12 -exportand imports them into the Liberty keystore viakeytool -importkeystore; on FIPS-enabled OCP clusters with OpenSSL 3.x, the generated .p12 files use PBMAC1 as the integrity MAC by default (OID 1.2.840.113549.1.5.14), which keytool in IBM Semeru 21.0.12 now strictly rejects with NoSuchAlgorithmException: Algorithm HmacPBE1.2.840.113549.1.5.14 not available — this worked silently in IBM Semeru 21.0.11Non-Working case: Java "21.0.12"
Working case: Java "21.0.11"