× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Oops. sb valocity. I keep doing that.
I'm mentioned them both below regarding my TLS check using https://www.htbridge.com/ssl

Peter


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bradley Stone
Sent: Thursday, 20 October 2016 8:35 AM
To: Midrange Systems Technical Discussion
Subject: Re: Die 7.1 Die! Was: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes

velocity-uat.co.nz won't resolve to an IP address. Typo?

Brad
www.bvstools.com

On Wed, Oct 19, 2016 at 2:21 PM, Peter Connell <Peter.Connell@xxxxxxxxxx>
wrote:

Yes, I've been thru all the stuff in that IBM support doc.
Our dev machine has QSSL* system values to enable all TLS versions and
the SSLCONFIG has been set to allow all the ciphers that IBM support at V7R1.
So I guess nobody knows of any such thing as a "GSK trace".

Brad,
The urls are valocity.co.nz (this connects OK) and velocity-uat.co.nz
(does not) I believe they use a white list to reject unlicensed client
connections but that should be after the handshake and that's where
it's failing.


Regards, Peter

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Rob Berendt
Sent: Thursday, 20 October 2016 2:07 AM
To: Midrange Systems Technical Discussion
Subject: Die 7.1 Die! Was: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes

<snip>
see if it's not V7R1 that has the issues. From what I understand
they're not updating SSL any more on V7R1 even though it's still
supported and behind as far as the required updates that were made at
the end of July for most SSL processes.
</snip>

Configuring Your IBM i System Secure Sockets Layer (SSL)/Transport
Layer Security (TLS) Protocols and Cipher Suites
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020876
Goes into detail on what PTF's you need (even at 7.1) and what Cipher
Suites are considered "weak". We recently had internal, and external,
scanning completed and had to go whole hog to purge these out.
Details on how to config this are in there.
Modified date: 2016-07-11

Now that I've added useful information I reserve the right to rant.
"IF" IBM is not enhancing 7.1 to new cipher suites and stuff they need
to announce end of support. The sooner the better. Especially for
those budgeting for next year.

Being purchased by a public company and having to go through SOX and
being behind on cipher suites does not go well.



Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Bradley Stone <bvstone@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 10/19/2016 08:26 AM
Subject: Re: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



My advice would be to test this on a V7R2 or R3 virtual loaner
partition (PDP https://www-356.ibm.com/partnerworld/wps/servlet/
ContentHandler/stg_com_sys_power-development-platform
)
and
see if it's not V7R1 that has the issues. From what I understand
they're not updating SSL any more on V7R1 even though it's still
supported and behind as far as the required updates that were made at
the end of July for most SSL processes.

I personally have seen this in the past and normally it was from
customers using GETURI on an older OS version that is no longer
supported. V5Rx and V6Rx specifically.


Brad
www.bvstools.com

On Tue, Oct 18, 2016 at 8:40 PM, Peter Connell
<Peter.Connell@xxxxxxxxxx>
wrote:



From: Peter Connell
Sent: Saturday, 15 October 2016 7:45 PM
To: 'midrange-l@xxxxxxxxxxxx'
Subject: gsk rc =415, GSK_ERROR_BAD_PEER woes

Hi ,

I'm still having trouble connecting to the test server of one of our
data
source providers using HTTPAPIR4.
Both our development machines are on V7R1 and using the latest
version
of
HTTPAPIR4 on the development machine to specifie the optional TLS
versions
in the https_init() call made no difference.
The connection works fine to the providers production machine using
our older version of HTTPAPIR4 which reports "Protocol Used: TLS Version 1"
in
the HTTPAPI debug output.
But the UAT connection attempt reports <<<<
recvresp(): entered
HTTP/1.1 200 Connection established

SetError() #13: HTTP/1.1 200 Connection established recvdoc parms:
identity 0
header_load_cookies() entered
(GSKit) Peer not recognized or badly formatted message received.
ssl_error(415): (GSKit) Peer not recognized or badly formatted
message received.
SetError() #30: SSL Handshake: (GSKit) Peer not recognized or badly
formatted message received.


I ran a TLS check using the online tool at
https://www.htbridge.com/ssl against both the provider urls which
are - valocity-uat.co.nz valocity.co.nz

Both of the provider servers support all TLS versions.
The only difference seems to be in the list of supported ciphers.

Note - authenticating with the provider is not straight forward
since they require generating a customized HTTP header containing a
base64
HMAC
hash but that's not the issue.

So I wrote a little java program to try connecting and found that at
our present version of JDK60 connected to the provider production
server but not the UAT server.
I noticed that JDK70 supports more ciphers and found that by
recompiling at JDK70 then both connections worked. So that says something at least.

We've applied the latest cume PTFs to our development machine and
that does seem to have made any difference. They are soon to be
applied in production.
On our development machine the QSSL* system values are set to
support
all
the TLS protocols and the SSLCONFIG macro via STRSST is configured
to support all the available ciphers that IBM support at V7R1.

Googling seems to show there is a GSK trace thing available on other
IBM machines.
Does anyone know if there is a GSK trace option on IBM i5?

Regards, Peter



##############################################################
This correspondence is for the named person's use only. It may
contain confidential or legally privileged information, or both. No
confidentiality
or privilege is waived or lost by any mistransmission. If you
receive
this
correspondence in error, please immediately delete it from your
system
and
notify the sender. You must not disclose, copy or rely on any part
of
this
correspondence if you are not the intended recipient. Any views
expressed
in this message are those of the individual sender, except where the
sender
expressly, and with authority, states them to be the views of Veda.
If
you
need assistance, please contact Veda :- Australia
http://www.veda.com.au/contact-us New Zealand
http://www.veda.co.nz/contact-veda
##############################################################

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please
take a moment to review the archives at
http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


##############################################################
This correspondence is for the named person's use only. It may contain
confidential or legally privileged information, or both. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this correspondence in error, please immediately delete
it from your system and notify the sender. You must not disclose, copy
or rely on any part of this correspondence if you are not the intended
recipient. Any views expressed in this message are those of the
individual sender, except where the sender expressly, and with
authority, states them to be the views of Veda. If you need
assistance, please contact Veda :- Australia
http://www.veda.com.au/contact-us New Zealand
http://www.veda.co.nz/contact-veda
##############################################################

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.


##############################################################
This correspondence is for the named person's use only. It may contain confidential or legally privileged information, or both. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this correspondence in error, please immediately delete it from your system and
notify the sender. You must not disclose, copy or rely on any part of this correspondence if you are not the intended recipient. Any views expressed in this message are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of Veda. If you need assistance, please contact Veda :-
Australia http://www.veda.com.au/contact-us
New Zealand http://www.veda.co.nz/contact-veda
##############################################################


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:
Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.