The Linux cheerleaders are hugging themselves with glee ever since IBM came down so heavily on their side. Personally, the more I use IBM software, the more convinced I become that their support is either a) an underhand Microsoft-funded sabotage attempt (paranoid conspiracy theory par excellence of every Linux hacker) or b) a curse. Of course they embraced Linux - did you ever try using AIX??

Here’s a fix for the NSAPI (Sun ONE/IPlanet) HTTP plugin in WebSphere Application Server 5.1 that you won’t find on the IBM support site (heck, you’re lucky to find the IBM support site).

We’re using WebSphere with Zeus Web Server on Solaris/SPARC, which also supports NSAPI extensions. Using the latest 5.1 plugin (libns41_http.so), we got the following error in the Zeus errors file after starting the instance:

Run-time exception error; current exception: GSKDBException No handler for exception.

I think this is a generic catch-all message (IBM’s only advice on the subject refers to Apache and can only helpfully suggest “restarting the web server”). Using “truss -fl” on the main Zeus parent process prior to starting the instance, I found the following in the output immediately before the error was logged:

26380/7: open(“/opt/WebSphere/AppServer/etc/plugin-keyrdb”, O_RDONLY) Err#2 ENOENT 26380/7: close(-1) Err#9 EBADF 26380/7: time() = 1087484502 26380/7: write(2, “ R u n - t i m e e x c”.., 59) = 59

The file it should be opening is plugin-key.rdb (for want of a period, lossage ensued). The same thing will also happen with the plugin-key.crl file. (I use truss a lot, but it puts me in mind of the saying, “when your only tool is a hammer, everything looks like a nail”. Trouble is, a hammer is often the only effective remedy for much of this shit.)

To fix this, simply create symlinks with the incorrect names in the WebSphere etc/ directory, pointing to the correct files:

ln -s plugin-key.rdb plugin-keyrdb

# ln -s plugin-key.crl plugin-keycrl

(And yes, just for you lovely people, I’m prepared to brave the rigours of IBM Support - “We need full debug output and your complete life story before we can start examining your PMR” - to report this issue.)

Update, 2004-06-25: With a little help from IBM, following a brief sightseeing tour of several blind alleys, I have found a fix. The fix is in PQ86671 for IHS 1.3.12 on Solaris (Possible security exposure with IBM HTTP Server regarding a denial-of-service attack at the SSL record/protocol layer), which contains GSKit 4.0.3.345 (later than the versions in either WebSphere 4.0.7 or 5.1.0.4). Confusion stems from the fact that the IPlanet plugin on Solaris uses an older version of GSKit than the other plugins, which ships with an older release of IHS; make sure you download the right version of the IHS fix.