SSL File transfer from Linux Server to mainframe suddenly fails for XCOM
Article ID: 206595
Updated On:
Products
Issue/Introduction
File transfers from the Linux Server to the mainframe suddenly began to fail.
An xcomtcp -ping, returns this error:
#XCOMU0298E Unable to allocate remote transaction program: Txpi 215: Socket send error return value = 9
And this error is in the xcom.log
XCOMU0780E Txpi 308: TxpiInitSSL Failed msg = <error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed> value = 4294967295:
Environment
- XCOM™ Data Transport® for z/OS
- OpenSSL
- XCOM™ Data Transport® for Linux PC
Cause
The original problem is that the client (Linux) fails to verify the certificate received from the server (MVS). In the case the server certificate on the Mainframe had expired.
Resolution
WORKAROUND (to be used only to get production up and running while troubleshooting)
Disable VERIFY_CERTIFICATE in Linux so the connection succeeds.
TROUBLESHOOT with the openssl utility
In order to manually perform the verification via openssl utility you need:
- The CA certificate store file from Unix (named in [CA]/INITIATE_SIDE in the SSL config file from Unix. Let's call it CA.cert
- The certificate presented by mainframe, which is named in [CERTIFICATE]/RECEIVE_SIDE in the SSL config file from MVS side. Let's call it server.cert
The command is openssl verify -verbose -purpose sslserver -CAfile CA.cert server.cert
That is, "verify with verbose output a certificate which is a server certificate (-purpose sslserver) stored in file server.cert and using file CA.cert as the CA certificate store".
This will give the reason why the certificate failed.
The verify utility is documented in OpenSSL Commands
The certificate verification might fail, for example, if the server certificate has expired.
If the server certificate has failed because it expired, a new certificate must be procured and installed
Additional Information
1) The Linux client certificate is passed to the Mainframe, where it is checked against the CA-certificate of the mainframe.
2) The Mainframe passes its server-certificate to the Linux Server, where it is checked against the CA-certificate. Note that the CA-certificate is the one from the Linux side.
3) If these 2 checks are passed successfully, the secure-XCOM file transfer is started.
Feedback
