ACF2 Certificate problem with TN3270 and AT-TLS: EZD1287I TTLS Error RC: 6 Initial Handshake and EZZ6035I RCODE: 1030-01

Products

• ACF2 - z/OS

Issue/Introduction

Upgrading z/OS 2.3 to 2.5 and converting from TN3270 built in SSL to using AT-TLS for TN3270 sessions.  Self-signed certificate is used and TCPIP errors show SSL handshake and EZZ6035I RCODE: 1030-01  TTLS Ioctl failed for query or init HS error.

EZZ6034I TN3270 CONN 000000xx LU **N/A**  ACCEPTED   23001 191          
  IP..PORT: ##.##.###.###..####                                        
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=xxxx  ,UID=0         ,GROUP=xxgrp  ,GID=####           
CAS2206I Function=DataGetFirst  ,Userid=xxxx                          
CAS2206I Ring Name=RINGNAME                                           
CAS2206I Usage=Personal len=055C     ptr=000000## 875230F0              
CAS2206I Label=CertLabel                                               
CAS2206I Subj DN   len=0000003E ptr=000000## 87524930                   
CAS2206I Certificate Owner xxxx                                       
CAS2206I Recd id len=00000037 Val=00.CN=xxxx,OU=ABC,O=ABC Bank,
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=0/0:0                    
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=xxxx  ,UID=0         ,GROUP=xxgrp  ,GID=####           
CAS2206I Function=DataGetNext   ,Userid=xxxx                          
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=8/8:44                   
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=xxxx  ,UID=0         ,GROUP=xxgrp  ,GID=####           
CAS2206I Function=DataAbortQuery,Userid=xxxx                          
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=0/0:0                    
CAS2205I REQUEST=R_datalib       ,EXIT=PRE ,RC=N/A                      
CAS2206I USER=xxxx  ,UID=0         ,GROUP=xxgrp  ,GID=####           
CAS2206I Function=GetUpdateCode ,Userid=xxxx                          
CAS2206I Ring Name=RINGNAME                                           
CAS2206I Ring Sequence #=00000003                                       
CAS2205I REQUEST=R_datalib       ,EXIT=POST,RC=0/0:0                    
EZD1287I TTLS Error RC:    6 Initial Handshake 216                      
  LOCAL: ##.#.###.#..#####                                             
  REMOTE: ##.##.###.###..#####                                          
  JOBNAME: jobName RULE: ruleName                                          
  USERID: xxxx GRPID: 0000000# ENVID: 0000000# CONNID: 000000##
EZZ6035I TN3270 DEBUG CONN   DETAIL 217                              
  IP..PORT: ##.##.###.###..#####                                     
  CONN: 000000##  LU:          MOD: EZBTTXPL                         
  RCODE: 1030-01  TTLS Ioctl failed for query or init HS.            
  PARM1: FFFFFFFF PARM2: 00000464 PARM3: 77B77221                    
EZZ6034I xxxx CONN 000000## LU **N/A**  CONN DROP  ERR 1030 218    
  IP..PORT: ##.##.###.###..#####                             EZBTTXPL

                                     

 

  

Environment

Release : 16.0

Component : ACF2 for z/OS

Resolution

The self signed certificate needs to have a private key and connected to keyring using DEFAULT(certname) specified to fix EZD1287I SSL handshake error. Sample commands to create self signed certificate and connect certificate to keyring using DEFAULT are shown below:

SET P(USER) DIV(CERTDATA) 
GENCERT xxxx.CERT SUBJ(CN='xxxx' OU='ABC' O='ABC Bank' L='CityName' S='AB' C=xx) LABEL(CertLabel)  

SET PROFILE(USER) DIVISION(KEYRING) 
CONNECT CERTDATA(xxxx.CERT) KEYRING(xxxx.KEYRING) DEFAULT(xxxx.CERT)
F ACF2,REBUILD(USR),CLASS(P)

PTFs LU03440 and LU01752 fix EZZ6035I RCODE: 1030-01  TTLS Ioctl failed for query or init HS error message.