Re: Die 7.1 Die! Was: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

Peter,

Sorry, I haven't followed the whole discussion, and I don't know if you 
got an answer?

But, I can tell you that we applied a PTF from IBM a month or so ago 
that completely broke everything that used IBM's SSL on our box. 
(Applications that used OpenSSL were fine, but those using GSKit or the 
SSL_xxx APIs did not work at all, including both HTTPAPI and IBM software.)

We worked with IBM for a long time on it, and eventually they found the 
problem and gave us a new PTF that fixed the problem.

Might be worth looking into if your symptoms are the same?

-SK


On 10/20/2016 1:33 AM, Peter Connell wrote:
> Not matter. I upgraded my Chrome and can see obsolete cipher diagnostic.
>
> -----Original Message-----
> From: Peter Connell
> Sent: Thursday, 20 October 2016 5:45 PM
> To: 'Midrange Systems Technical Discussion'
> Subject: RE: Die 7.1 Die! Was: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes
>
> BTW, how do you get Chrome to show that?
> When I click on the padlock icon I don't see that.
>
> Peter
>
> -----Original Message-----
> From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bradley Stone
> Sent: Thursday, 20 October 2016 8:57 AM
> To: Midrange Systems Technical Discussion
> Subject: Re: Die 7.1 Die! Was: FW: gsk rc =415, GSK_ERROR_BAD_PEER woes
>
> Interesting.  Using GETURI (which uses the base SSL APIs) :
>
> With valocity.co.nz I get RC(-23) which is easy enough to fix by importing their CAs
>
> For valocity-uat.co.nz I get RC(-10) which is SSL_ERROR_IO.
>
> When I visit the latter with chrome and view the SSL info I get:
> The connection to this site uses a strong protocol (TLS 1.2), a strong key exchange (ECDHE_RSA), and an obsolete cipher (AES_256_CBC with HMAC-SHA1).
>
> An "obsolete cipher"?
>
> I got the same results after importing their CAs.
>
> The main certificate (not the CAs) also expires in a few days (Oct 24, 2016).
>
> Brad
> www.bvstools.com
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related questions.
>
>
> ##############################################################
> This correspondence is for the named person's use only. It may contain confidential or legally privileged information, or both. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this correspondence in error, please immediately delete it from your system and
> notify the sender. You must not disclose, copy or rely on any part of this correspondence if you are not the intended recipient. Any views expressed in this message are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of Veda. If you need assistance, please contact Veda :-
> Australia http://www.veda.com.au/contact-us
> New Zealand http://www.veda.co.nz/contact-veda
> ##############################################################