Re: SSL client connection error - SSL_Handshake(): Peer not recognized or badly formatted message received.

Kudos to IBM for this. Thanks for sharing, it Paul.

I may include this information on my page for my customers that are dealing
with these same problems (which we got around, but still, it's nice to know
IBM helped out and actually fixed it).

Brad
www.bvstools.com

On Tue, Jul 14, 2015 at 2:48 PM, Steinmetz, Paul <PSteinmetz@xxxxxxxxxx>
wrote:

IBM has released two PTFs to resolve SSL client issues, MF60335, SI57332


http://www-01.ibm.com/support/docview.wss?uid=nas35a3400efeeb413d086257e7e007eb665

http://www-01.ibm.com/support/docview.wss?uid=nas24e5145dca463e43586257e6f003c6da7


http://www-912.ibm.com/a_dir/as4ptf.nsf/b3cb9d42f672b70f86256739004afa0f/9d8f3c581309ec3886257e7e007eb678?OpenDocument

http://www-01.ibm.com/support/docview.wss?uid=nas22105ec3f6fa1476986257e74003c6ed6

Applied to R&D, issue resolved.

Make sure you run the special instructions SST Advanced Analysis SSLCONFIG
MACRO. !!!!!!
1. Open a character-based interface.
2. On the command line, type STRSST.
3. Type your service tools user name and password.
4. Select option 1 (Start a service tool).
5. Select option 4 (Display/Alter/Dump).
6. Select option 1 (Display/Alter storage).
7. Select option 2 (Licensed Internal Code (LIC) data).
8. Select option 14 (Advanced analysis).
9. Select option 1 (SSLCONFIG).
10. Enter -h
-eligibleDefaultProtocols:10,08,04 or as needed.

If your iSeries is a client, get these two PTFs installed ASAP.

Note:!!!!!!
Not only was my SSL client connection issue resolved, but other apps
previously connecting at TLSv1 are now connecting at TLSv1.2 or TLSv1.1.
Also, another app previously connecting TLSv1.0 using RC4 weak cipher now
connecting at TLSv1.2 with TLS_RSA_WITH_AES_128_CBC_SHA2

Good job IBM.
Quick turnaround.

Paul