Re: Die 7.1 Die! Was: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes

<snip>
see if it's not V7R1 that has the issues. From what I understand they're
not updating SSL any more on V7R1 even though it's still supported and
behind as far as the required updates that were made at the end of July
for
most SSL processes.
</snip>

Configuring Your IBM i System Secure Sockets Layer (SSL)/Transport Layer
Security (TLS) Protocols and Cipher Suites
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020876
Goes into detail on what PTF's you need (even at 7.1) and what Cipher
Suites are considered "weak". We recently had internal, and external,
scanning completed and had to go whole hog to purge these out.
Details on how to config this are in there.
Modified date: 2016-07-11

Now that I've added useful information I reserve the right to rant.
"IF" IBM is not enhancing 7.1 to new cipher suites and stuff they need to
announce end of support. The sooner the better. Especially for those
budgeting for next year.

Being purchased by a public company and having to go through SOX and being
behind on cipher suites does not go well.



Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Bradley Stone <bvstone@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 10/19/2016 08:26 AM
Subject: Re: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



My advice would be to test this on a V7R2 or R3 virtual loaner partition
(PDP
https://www-356.ibm.com/partnerworld/wps/servlet/
ContentHandler/stg_com_sys_power-development-platform
)
and
see if it's not V7R1 that has the issues. From what I understand they're
not updating SSL any more on V7R1 even though it's still supported and
behind as far as the required updates that were made at the end of July
for
most SSL processes.

I personally have seen this in the past and normally it was from customers
using GETURI on an older OS version that is no longer supported. V5Rx and
V6Rx specifically.


Brad
www.bvstools.com

On Tue, Oct 18, 2016 at 8:40 PM, Peter Connell <Peter.Connell@xxxxxxxxxx>
wrote:

From: Peter Connell
Sent: Saturday, 15 October 2016 7:45 PM
To: 'midrange-l@xxxxxxxxxxxx'
Subject: gsk rc =415, GSK_ERROR_BAD_PEER woes

Hi ,

I'm still having trouble connecting to the test server of one of our

data

source providers using HTTPAPIR4.
Both our development machines are on V7R1 and using the latest version

of

HTTPAPIR4 on the development machine to specifie the optional TLS

versions

in the https_init() call made no difference.
The connection works fine to the providers production machine using our
older version of HTTPAPIR4 which reports "Protocol Used: TLS Version 1"

in

the HTTPAPI debug output.
But the UAT connection attempt reports
<<<<
recvresp(): entered
HTTP/1.1 200 Connection established

SetError() #13: HTTP/1.1 200 Connection established
recvdoc parms: identity 0
header_load_cookies() entered
(GSKit) Peer not recognized or badly formatted message received.
ssl_error(415): (GSKit) Peer not recognized or badly formatted message
received.
SetError() #30: SSL Handshake: (GSKit) Peer not recognized or badly
formatted message received.

I ran a TLS check using the online tool at https://www.htbridge.com/ssl
against both the provider urls which are -
valocity-uat.co.nz
valocity.co.nz

Both of the provider servers support all TLS versions.
The only difference seems to be in the list of supported ciphers.

Note - authenticating with the provider is not straight forward since
they require generating a customized HTTP header containing a base64

HMAC

hash but that's not the issue.

So I wrote a little java program to try connecting and found that at our
present version of JDK60 connected to the provider production server but
not the UAT server.
I noticed that JDK70 supports more ciphers and found that by recompiling
at JDK70 then both connections worked. So that says something at least.

We've applied the latest cume PTFs to our development machine and that
does seem to have made any difference. They are soon to be applied in
production.
On our development machine the QSSL* system values are set to support

all

the TLS protocols and the SSLCONFIG macro via STRSST is configured to
support all the available ciphers that IBM support at V7R1.

Googling seems to show there is a GSK trace thing available on other IBM
machines.
Does anyone know if there is a GSK trace option on IBM i5?

Regards, Peter



##############################################################
This correspondence is for the named person's use only. It may contain
confidential or legally privileged information, or both. No

confidentiality

or privilege is waived or lost by any mistransmission. If you receive

this

correspondence in error, please immediately delete it from your system

and

notify the sender. You must not disclose, copy or rely on any part of

this

correspondence if you are not the intended recipient. Any views

expressed

in this message are those of the individual sender, except where the

sender

expressly, and with authority, states them to be the views of Veda. If

you

need assistance, please contact Veda :-
Australia http://www.veda.com.au/contact-us
New Zealand http://www.veda.co.nz/contact-veda
##############################################################

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.