Password/Phrase masking stops at a ')' or a ',' Password masking stops at a blank.
The password/phrase in message CTS3600I will not be fully masked.
Instead of:
CTS3600I TSS REPLACE(user) PHRASE('*****)fox',,EXPIRED)
It should be:
CTS3600I TSS REPLACE(user) PHRASE('*********',,EXPIRED)