ACF2 Certificate problem with TN3270 and AT-TLS: EZD1287I TTLS Error RC: 6 Initial Handshake and EZZ6035I RCODE: 1030-01

Products

• ACF2 - z/OS

Issue/Introduction

Upgrading z/OS 2.3 to 2.5 and converting from TN3270 built in SSL to using AT-TLS for TN3270 sessions.  Self-signed certificate is used and TCPIP errors show SSL handshake and EZZ6035I RCODE: 1030-01  TTLS Ioctl failed for query or init HS error.

EZZ6034I TN3270 CONN 000000B2 LU **N/A**  ACCEPTED   23001 191          
  IP..PORT: 10.14.232.185..64675                                        
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=TN3270  ,UID=0         ,GROUP=STCGRP  ,GID=2000           
CAS2206I Function=DataGetFirst  ,Userid=TN3270                          
CAS2206I Ring Name=TN3270RING                                           
CAS2206I Usage=Personal len=055C     ptr=00000051 875230F0              
CAS2206I Label=TN3270Cert                                               
CAS2206I Subj DN   len=0000003E ptr=00000051 87524930                   
CAS2206I Certificate Owner TN3270                                       
CAS2206I Recd id len=00000037 Val=00.CN=TN3270,OU=MFS,O=ABC Bank,
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=0/0:0                    
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=TN3270  ,UID=0         ,GROUP=STCGRP  ,GID=2000           
CAS2206I Function=DataGetNext   ,Userid=TN3270                          
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=8/8:44                   
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=TN3270  ,UID=0         ,GROUP=STCGRP  ,GID=2000           
CAS2206I Function=DataAbortQuery,Userid=TN3270                          
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=0/0:0                    
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=TN3270  ,UID=0         ,GROUP=STCGRP  ,GID=2000           
CAS2206I Function=GetUpdateCode ,Userid=TN3270                          
CAS2206I Ring Name=TN3270RING                                           
CAS2206I Ring Sequence #=00000003                                       
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=0/0:0                    
EZD1287I TTLS Error RC:    6 Initial Handshake 216                      
  LOCAL: 10.8.188.1..23001                                              
  REMOTE: 10.14.232.185..64675                                          
  JOBNAME: TN3270 RULE: TN3270                                          
  USERID: TN3270 GRPID: 00000003 ENVID: 00000001 CONNID: 000000B2
EZZ6035I TN3270 DEBUG CONN   DETAIL 217                              
  IP..PORT: 10.14.232.185..64675                                     
  CONN: 000000B2  LU:          MOD: EZBTTXPL                         
  RCODE: 1030-01  TTLS Ioctl failed for query or init HS.            
  PARM1: FFFFFFFF PARM2: 00000464 PARM3: 77B77221                    
EZZ6034I TN3270 CONN 000000B2 LU **N/A**  CONN DROP  ERR 1030 218    
  IP..PORT: 10.14.232.185..64675                             EZBTTXPL

                                     

 

  

Environment

Release : 16.0

Component : ACF2 for z/OS

Resolution

The self signed certificate needs to have a private key and connected to keyring using DEFAULT(certname) specified to fix EZD1287I SSL handshake error. Sample commands to create self signed certificate and connect certificate to keyring using DEFAULT are shown below:

SET P(USER) DIV(CERTDATA) 
GENCERT TN3270.CERT SUBJ(CN='TN3270' OU='ABC' O='ABC Bank' L='NewYork' S='AB' C=US) LABEL(TN3270Cert)  

SET PROFILE(USER) DIVISION(KEYRING) 
CONNECT CERTDATA(TN3270.CERT) KEYRING(TN3270.KEYRING) DEFAULT(TN3270.CERT)
F ACF2,REBUILD(USR),CLASS(P)

PTFs LU03440 and LU01752 fix EZZ6035I RCODE: 1030-01  TTLS Ioctl failed for query or init HS error message.