Re: SSL gskit handshake errors

HTTPAPI calls the gsk_* functions on your behalf.  If you're using this callback, you'd be doing so by coding something like:

*http_xproc( HTTP_POINT_GSKIT_CERT_VAL: %paddr(myProcedure));*

I'm guessing that you're not doing that, so probably that APAR didn't apply to your situation.   I wonder if the API you're connecting to might change servers at night?  Perhaps they have a fallback server that they go to while doing maintenance (such as a nightly backup, etc) and it uses different ciphers?

I'm not sure what's going on, though, just taking guesses.  If retrying is enough to solve the problem, maybe that's the best solution for now.


On 11/10/2020 1:11 PM, Gerald Magnuson wrote:

I see that a while ago (10 YEARS), I had troubles with authority to the
certificate store, and was falling into the certification validation
callback.
I don't see any reference in my code to any gsk_* functions

On Tue, Nov 10, 2020 at 12:52 PM Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
wrote:

I would simply guess that no, I don't use the certificate validation
callback.


On Tue, Nov 10, 2020 at 12:20 PM Scott Klement <web400@xxxxxxxxxxxxxxxx>
wrote:

Seems to me that the APAR description refers to only situations where
you're using the certificate validation callback. Are you using that?
In my experience, not too many people do.

On 11/10/2020 8:46 AM, Gerald Magnuson wrote:

It may fix those who are using TLSv1.2, since the APAR description

details

that.
I only see the errors when I use TLSv1.3 and the TLSv1.3 ciphers.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.