Upgrading z/OS 2.3 to 2.5 and converting from TN3270 built in SSL to using AT-TLS for TN3270 sessions. Self-signed certificate is used and TCPIP errors show SSL handshake and EZZ6035I RCODE: 1030-01 TTLS Ioctl failed for query or init HS error.
EZZ6034I TN3270 CONN 000000xx LU **N/A** ACCEPTED 23001 191
IP..PORT: ##.##.###.###..####
CAS2205I REQUEST=R_datalib ,EXIT=PRE ,RC=N/A
CAS2206I USER=xxxx ,UID=0 ,GROUP=xxgrp ,GID=####
CAS2206I Function=DataGetFirst ,Userid=xxxx
CAS2206I Ring Name=RINGNAME
CAS2206I Usage=Personal len=055C ptr=000000## 875230F0
CAS2206I Label=CertLabel
CAS2206I Subj DN len=0000003E ptr=000000## 87524930
CAS2206I Certificate Owner xxxx
CAS2206I Recd id len=00000037 Val=00.CN=xxxx,OU=ABC,O=ABC Bank,
CAS2205I REQUEST=R_datalib ,EXIT=POST,RC=0/0:0
CAS2205I REQUEST=R_datalib ,EXIT=PRE ,RC=N/A
CAS2206I USER=xxxx ,UID=0 ,GROUP=xxgrp ,GID=####
CAS2206I Function=DataGetNext ,Userid=xxxx
CAS2205I REQUEST=R_datalib ,EXIT=POST,RC=8/8:44
CAS2205I REQUEST=R_datalib ,EXIT=PRE ,RC=N/A
CAS2206I USER=xxxx ,UID=0 ,GROUP=xxgrp ,GID=####
CAS2206I Function=DataAbortQuery,Userid=xxxx
CAS2205I REQUEST=R_datalib ,EXIT=POST,RC=0/0:0
CAS2205I REQUEST=R_datalib ,EXIT=PRE ,RC=N/A
CAS2206I USER=xxxx ,UID=0 ,GROUP=xxgrp ,GID=####
CAS2206I Function=GetUpdateCode ,Userid=xxxx
CAS2206I Ring Name=RINGNAME
CAS2206I Ring Sequence #=00000003
CAS2205I REQUEST=R_datalib ,EXIT=POST,RC=0/0:0
EZD1287I TTLS Error RC: 6 Initial Handshake 216
LOCAL: ##.#.###.#..#####
REMOTE: ##.##.###.###..#####
JOBNAME: jobName RULE: ruleName
USERID: xxxx GRPID: 0000000# ENVID: 0000000# CONNID: 000000##
EZZ6035I TN3270 DEBUG CONN DETAIL 217
IP..PORT: ##.##.###.###..#####
CONN: 000000## LU: MOD: EZBTTXPL
RCODE: 1030-01 TTLS Ioctl failed for query or init HS.
PARM1: FFFFFFFF PARM2: 00000464 PARM3: 77B77221
EZZ6034I xxxx CONN 000000## LU **N/A** CONN DROP ERR 1030 218
IP..PORT: ##.##.###.###..##### EZBTTXPL
Release : 16.0
Component : ACF2 for z/OS
The self signed certificate needs to have a private key and connected to keyring using DEFAULT(certname) specified to fix EZD1287I SSL handshake error. Sample commands to create self signed certificate and connect certificate to keyring using DEFAULT are shown below:
SET P(USER) DIV(CERTDATA)
GENCERT xxxx.CERT SUBJ(CN='xxxx' OU='ABC' O='ABC Bank' L='CityName' S='AB' C=xx) LABEL(CertLabel)
SET PROFILE(USER) DIVISION(KEYRING)
CONNECT CERTDATA(xxxx.CERT) KEYRING(xxxx.KEYRING) DEFAULT(xxxx.CERT)
F ACF2,REBUILD(USR),CLASS(P)
PTFs LU03440 and LU01752 fix EZZ6035I RCODE: 1030-01 TTLS Ioctl failed for query or init HS error message.