I'd check your ciphers. It's possible they changed during the upgrade. On 7.3, they're found Configuration and Service->System Values then System TLS tab.
HTH
-----Original Message-----
From: Troy Hyde [mailto:troy.hyde@xxxxxxxxxxx]
Sent: Friday, February 14, 2020 8:01 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: Secure FTP (FTPS) battle when moving to V7R4
Sometimes something is so far out of your wheelhouse that you are not even sure what you don’t know that you don’t know. When that’s the case but you’re the one in the building that knows the most about it, it become comic.
We have a client that upgraded their server (a whole new box.) They went from V7R1 to V7R4 and we have been unable to get a secure FTP connection (that was working before) working now.
For this process we use the command line FTP feature. FTP
RMTSYS('xxx.xxx.xxx.xxx') SECCNN(*SSL). We have setup the digital certificate manager settings so the IBM i TCP/IP FTP Client is configured as closely as possible to the way it was setup on the old box. The connection’s certificates are included in the CA Trust List and the Cipher suites seem to be correclty defined.
When we attempt to connect, we get connected and then immediately
disconnected:
Connecting to remote host 198.217.221.3 using port 21.
220-FTP 13:29:00 on 2020-02-14.
220--------------------------------------------------------------------
220-This is a restricted system and is for the express use by authorized
220-personnel only. Unauthorized attempts to defeat or circumvent
…… continues for a while
220--------------------------------------------------------------------
220 Connection will close if idle for more than 12 minutes.
AUTH TLS
234 Security environment established - ready for negotiation
Secure connection error, return code -16.
For the longest time we were then getting
Secure connection error, return code -1.
Help indicates: “Secure Sockets Layer (SSL) function SSL_Handshake returned code -1: No ciphers available or specified.”
After a lot delete and create of stores and self-signed certificates, configuring the application to use the supported suites, changing of QSSL* system values and a thousand other combinations of attempts, it appears the proper cipher suite is now being used. We are now getting code -16 instead.
16 is described as “The peer system is not recognized.”
First I’m not sure if this means that they are disconnecting us because they don’t recognize us or we are disconnecting them because we don’t trust them.
Secondly, any suggestions for where in the world we go from here?
Troy Hyde
midrange.com
