Re: SSL gskit handshake errors

no not forcing it.  I have a mix of ciphers and protocols.
yes the end point supports it.  98% of the calls go through fine with
SSLv1.3.

and of the errors,,,  95% of them happen between 5am and 10am.



On Tue, Nov 10, 2020 at 8:50 AM Charles Wilt <[email protected]> wrote:

> Are you forcing 1.3?  Does the endpoint support it?
>
> IIRC, That message is common when there's no compatible version between the
> endpoints..
>
> Charles
>
> On Tue, Nov 10, 2020 at 7:47 AM Gerald Magnuson <
> [email protected]>
> wrote:
>
> > It may fix those who are using TLSv1.2, since the APAR description
> details
> > that.
> > I only see the errors when I use TLSv1.3 and the TLSv1.3 ciphers.
> >
> >
> > On Tue, Nov 10, 2020 at 8:39 AM Brad Stone <[email protected]> wrote:
> >
> > > Bummer.  Thanks for the update.
> > >
> > > On Tue, Nov 10, 2020 at 8:03 AM Gerald Magnuson <
> > > [email protected]>
> > > wrote:
> > >
> > > > Nope.
> > > > still have the "ssl_error(415): (GSKit) Peer not recognized or badly
> > > > formatted message received."  errors.
> > > >
> > > >
> > > > On Mon, Nov 9, 2020 at 10:54 AM Gerald Magnuson <
> > > > [email protected]>
> > > > wrote:
> > > >
> > > > > I just found and applied MF67905.
> > > > >
> > > > > DESCRIPTION OF PROBLEM FIXED FOR APAR MA48640 :
> > > > > -----------------------------------------------
> > > > >    When a callback function is set on gsk_attribute_set_callback()
> > > > >    for GSK_CERT_VALIDATION_CALLBACK, TLSv1.2 cached handshakes fail
> > > > >    with GSK_ERROR_BAD_PEER.
> > > > >
> > > > > CORRECTION FOR APAR MA48640 :
> > > > > -----------------------------
> > > > >    The TLSv1.2 handshake path was updated to properly handle cached
> > > > >    handshakes when there is a callback function set on
> > > > >    gsk_attribute_set_callback() for GSK_CERT_VALIDATION_CALLBACK.
> > > > >
> > > > >
> > > > > I have just  applied said ptf,  and will see how it goes.
> > > > >
> > > > >
> > > > --
> > > > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)
> > mailing
> > > > list
> > > > To post a message email: [email protected]
> > > > To subscribe, unsubscribe, or change list options,
> > > > visit: https://lists.midrange.com/mailman/listinfo/web400
> > > > or email: [email protected]
> > > > Before posting, please take a moment to review the archives
> > > > at https://archive.midrange.com/web400.
> > > >
> > > >
> > > --
> > > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400)
> mailing
> > > list
> > > To post a message email: [email protected]
> > > To subscribe, unsubscribe, or change list options,
> > > visit: https://lists.midrange.com/mailman/listinfo/web400
> > > or email: [email protected]
> > > Before posting, please take a moment to review the archives
> > > at https://archive.midrange.com/web400.
> > >
> > >
> > --
> > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> > list
> > To post a message email: [email protected]
> > To subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/web400
> > or email: [email protected]
> > Before posting, please take a moment to review the archives
> > at https://archive.midrange.com/web400.
> >
> >
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: [email protected]
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: [email protected]
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.
>
>
-- 
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.