Re: SSL gskit handshake errors

Are you forcing 1.3? Does the endpoint support it?

IIRC, That message is common when there's no compatible version between the
endpoints..

Charles

On Tue, Nov 10, 2020 at 7:47 AM Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
wrote:

It may fix those who are using TLSv1.2, since the APAR description details
that.
I only see the errors when I use TLSv1.3 and the TLSv1.3 ciphers.


On Tue, Nov 10, 2020 at 8:39 AM Brad Stone <bvstone@xxxxxxxxx> wrote:

Bummer. Thanks for the update.

On Tue, Nov 10, 2020 at 8:03 AM Gerald Magnuson <
gmagqcy.midrange@xxxxxxxxx>
wrote:

Nope.
still have the "ssl_error(415): (GSKit) Peer not recognized or badly
formatted message received." errors.


On Mon, Nov 9, 2020 at 10:54 AM Gerald Magnuson <
gmagqcy.midrange@xxxxxxxxx>
wrote:

I just found and applied MF67905.

DESCRIPTION OF PROBLEM FIXED FOR APAR MA48640 :
-----------------------------------------------
When a callback function is set on gsk_attribute_set_callback()
for GSK_CERT_VALIDATION_CALLBACK, TLSv1.2 cached handshakes fail
with GSK_ERROR_BAD_PEER.

CORRECTION FOR APAR MA48640 :
-----------------------------
The TLSv1.2 handshake path was updated to properly handle cached
handshakes when there is a callback function set on
gsk_attribute_set_callback() for GSK_CERT_VALIDATION_CALLBACK.


I have just applied said ptf, and will see how it goes.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)

mailing

list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.