XCOMM1512E System SSL XCOM_CONFIG_SSL error
Article ID: 274620
Updated On:
Products
Issue/Introduction
After applying PTF LU07625 secured transfers are failing with message:
XCOMM1512E System SSL XCOM_CONFIG_SSL error. One or more verify criteria were not met.
The value of parameter XCOM_CONFIG_SSL was verified and the parameter in the SYSconfigssl.cnf file has the proper values.
Environment
XCOM™ Data Transport® for z/OS
Cause
After the removal of the ETPKI from the file, LU07625 also addressed the functions to read and parse the System SSL configuration file.
Resolution
In this specific case, comment out the [HOST_NAME] section from the SYSconfigssl.cnf file, since there is no hostname value to match in the SSL certificate.
If there is a [HOST_NAME] section in the SSL config file, then System SSL expects that there will at least be some hostname in the certificates being used.
If INITIATE_SITE and/or RECEIVE_SITE are blank, it will match any hostname, but there must be one in the certificate. That is why removing [HOST_NAME] from the SSL config makes the secured transfer work. That tells us that the certificate being used does not have any hostnames in them.
[HOST_NAME] in the SSL config file on z/OS only applies to how z/OS will match hostnames in certificates. It does not impact other partners because that information is only compared in the Local system. It is not transmitted over the network.
So, don't specify any function/parameter in the SYSconfigssl.cnf file that does not have a match in the certificate.
Additional Information
Feedback
