|
From: Peter Connell
Sent: Saturday, 15 October 2016 7:45 PM
To: 'midrange-l@xxxxxxxxxxxx'
Subject: gsk rc =415, GSK_ERROR_BAD_PEER woes
Hi ,
I'm still having trouble connecting to the test server of one of our data source providers using HTTPAPIR4.
Both our development machines are on V7R1 and using the latest version of HTTPAPIR4 on the development machine to specifie the optional TLS versions in the https_init() call made no difference.
The connection works fine to the providers production machine using our older version of HTTPAPIR4 which reports "Protocol Used: TLS Version 1" in the HTTPAPI debug output.
But the UAT connection attempt reports
<<<<
recvresp(): entered
HTTP/1.1 200 Connection established
SetError() #13: HTTP/1.1 200 Connection established
recvdoc parms: identity 0
header_load_cookies() entered
(GSKit) Peer not recognized or badly formatted message received.
ssl_error(415): (GSKit) Peer not recognized or badly formatted message received.
SetError() #30: SSL Handshake: (GSKit) Peer not recognized or badly formatted message received.
I ran a TLS check using the online tool at https://www.htbridge.com/ssl against both the provider urls which are -
valocity-uat.co.nz
valocity.co.nz
Both of the provider servers support all TLS versions.
The only difference seems to be in the list of supported ciphers.
Note - authenticating with the provider is not straight forward since they require generating a customized HTTP header containing a base64 HMAC hash but that's not the issue.
So I wrote a little java program to try connecting and found that at our present version of JDK60 connected to the provider production server but not the UAT server.
I noticed that JDK70 supports more ciphers and found that by recompiling at JDK70 then both connections worked. So that says something at least.
We've applied the latest cume PTFs to our development machine and that does seem to have made any difference. They are soon to be applied in production.
On our development machine the QSSL* system values are set to support all the TLS protocols and the SSLCONFIG macro via STRSST is configured to support all the available ciphers that IBM support at V7R1.
Googling seems to show there is a GSK trace thing available on other IBM machines.
Does anyone know if there is a GSK trace option on IBM i5?
Regards, Peter
##############################################################
This correspondence is for the named person's use only. It may contain confidential or legally privileged information, or both. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this correspondence in error, please immediately delete it from your system and
notify the sender. You must not disclose, copy or rely on any part of this correspondence if you are not the intended recipient. Any views expressed in this message are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of Veda. If you need assistance, please contact Veda :-
Australia http://www.veda.com.au/contact-us
New Zealand http://www.veda.co.nz/contact-veda
##############################################################
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
