Impossible to start debug service

[nathanaelGaia]

Hi team.
It seems impossible to start the debug service. I have the same problem on several LPARs.

Description :
With Navigator for i -> Network > Servers > TCP/IP Servers -> System Debugger -> Start Instance -> Debug Service
It fails and genrates the file : /qibm/userdata/IBMIDEBUGSERVICE/DebugService_log.txt
Content :
Failed to get keystore password.
java.security.UnrecoverableKeyException: The password is incorrect, regenerate on Navigator
at com.ibm.navigator.debugger.Decoder.checkPassword(Decoder.java:341)
at com.ibm.navigator.debugger.Decoder.access$100(Decoder.java:51)
at com.ibm.navigator.debugger.Decoder$1.run(Decoder.java:99)
at java.base/java.lang.Thread.run(Thread.java:853)
at com.ibm.navigator.debugger.Decoder$DebuggerHighAuthorityThread.run(Decoder.java:742)

Environment :
IBM i 7.6
debugger 3.0.0
Java 17
All PTFs applied : https://codefori.github.io/docs/developing/debug/configure/

I checked the content of
/QIBM/ProdData/IBMIDEBUGSERVICE/bin/DebugService.env
/QIBM/UserData/IBMIDEBUGSERVICE/certs
/QIBM/UserData/IBMIDEBUGSERVICE/C4iDebugService.env

Thanks for support

[sebCIL]

I have the same issue and same error log on all my recently updated partitions.

[bhunsicker1]

Hello. I am having the same issue. I am running 7.4 of IBMi.
bash-5.2$ java version "11.0.29" 2025-10-21
IBM Semeru Runtime Certified Edition (build 11.0.29+7)
Eclipse OpenJ9 VM (build openj9-0.56.0, JRE 11 OS/400 ppc64-64-Bit Compressed Re ferences 20251130_000000 (JIT enabled, AOT enabled)
OpenJ9 - 14b3b2de26
OMR - d4c7e3040
JCL - 811948e3ec based on jdk-11.0.29+7 )
Failed to get keystore password.
java.security.UnrecoverableKeyException: The password is incorrect, regenerate o n Navigator
at com.ibm.navigator.debugger.Decoder.checkPassword(Decoder.java:341)
at com.ibm.navigator.debugger.Decoder.getPassword(Decoder.java:111)
at com.ibm.etools.iseries.daas.internal.application.DAASISeriesApplicati on.start(DAASISeriesApplication.java:82)
at com.ibm.debug.pdt.daas.internal.application.DAASPDTApplication.start( DAASPDTApplication.java:79)
at org.eclipse.equinox.internal.app.EclipseAppHandle.run(EclipseAppHandl e.java:203)
at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.runAppli cation(EclipseAppLauncher.java:136)
at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.start(Ec lipseAppLauncher.java:104)
at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.ja va:401)
at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.ja va:255)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Nativ e Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Native MethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(De legatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:572)
at org.eclipse.equinox.launcher.Main.invokeFramework(Main.java:659)
at org.eclipse.equinox.launcher.Main.basicRun(Main.java:596)
at org.eclipse.equinox.launcher.Main.run(Main.java:1467)
at org.eclipse.equinox.launcher.Main.main(Main.java:1440)

this is starting with shell.
I did try via navigator.
I did regenerate the cert.

[zkarj735]

We also have the same issue, having just done a regular IPL with PTF updates. IBM i 7.4. I also regenerated the Trust Store.

java version "11.0.28" 2025-07-15
IBM Semeru Runtime Certified Edition (build 11.0.28+6)
Eclipse OpenJ9 VM (build openj9-0.53.0, JRE 11 OS/400 ppc64-64-Bit Compressed References 20250908_000000 (JIT enabled, AOT enabled)
OpenJ9 - 017819f167
OMR - 266a8c6f5
JCL - 640b5ea777 based on jdk-11.0.28+6)
Failed to get keystore password.
com.ibm.as400.access.AS400SecurityException: Password is not set.
at com.ibm.as400.access.AS400.sendSignonRequest(AS400.java:4225)
at com.ibm.as400.access.AS400.promptSignon(AS400.java:3811)
at com.ibm.as400.access.AS400.signon(AS400.java:5391)
at com.ibm.as400.access.ProgramCall.chooseImpl(ProgramCall.java:413)
at com.ibm.as400.access.ProgramCall.run(ProgramCall.java:775)
at com.ibm.navigator.debugger.RetrieveKeystoreFileAttributes.retrieveKeystoreFileAttributes(RetrieveKeystoreFileAttributes.java:115
at com.ibm.navigator.debugger.Decoder.getKeystoreFileAttributes(Decoder.java:472)
at com.ibm.navigator.debugger.Decoder.getKeystore(Decoder.java:422)
at com.ibm.navigator.debugger.Decoder.getKey(Decoder.java:398)
at com.ibm.navigator.debugger.Decoder.checkPassword(Decoder.java:319)
at com.ibm.navigator.debugger.Decoder.checkPassword(Decoder.java:319)
at com.ibm.navigator.debugger.Decoder.access$100(Decoder.java:51)
at com.ibm.navigator.debugger.Decoder$1.run(Decoder.java:99)
at java.base/java.lang.Thread.run(Thread.java:835)
at com.ibm.navigator.debugger.Decoder$DebuggerHighAuthorityThread.run(Decoder.java:742)

[sebjulliand]

@zkarj735 your error is a bit different.
It seems that the profile that starts/runs the service has its PASSWORD parameter set to *NONE.
That prevents JTOpen from using it to connect to the system and call the program that should decrypt the keystore password.

[nathanaelGaia]

IBM supports helps me on the debug service : remove and re-apply PTFs SJ08175 SJ08174

ENDTCPSVR SERVER(*DBG)
ENDTCPSVR SERVER(*IAS) INSTANCE(ADMIN1)
RMVPTF LICPGM(5770SS1) SELECT(SJ08175 SJ08174) DELAYED(*NO)APYPTF LICPGM(5770SS1) SELECT(SJ08175 SJ08174) DELAYED(*NO)
ADMIN1 STRTCPSVR SERVER(*IAS) INSTANCE(ADMIN1)

Now the debug service starts from Nav4i.

But in codefori, I still have an error when trying to set an entry point : EQAVS1007E neptune.gaia.lan on port 8005 could not be connected. Message received : self signed certificate in certificate chain

I checked the certificate : same on the IBM i in /QIBM/UserData/IBMiDebugService/certs/debug_service.crt and on my PC in C:\Users\nbonnet\neptune.gaia.lan_debug_service.crt (neptune.gaia.lan is my system name).

[bhunsicker1]

We tried the same as nathanaelGaia reported earlier today. Except we are 7.4 so we removed and re-applied the 7.4 ptf. (sj08192,sj08177) We can now start the debug service from navigator, but in vscode, we get the self signed certificate in certificate chain message.

[zkarj735]

It seems that the profile that starts/runs the service has its PASSWORD parameter set to *NONE.

Thanks for spotting that. That's correct, but I'm using a helper command we built to run the shell command and it was working. We were running it under the QDBGSRV profile.

What is the recommended profile?

[zkarj735]

I also note when trying to start it from Navigator that it produces the following error:

Failed to start the Debug Service. Details:QSECOFR must be enabled and have a valid password to start debug service

Except, QSECOFR definitely has a password and is enabled. Always.