GIM69207S error with javax.net.ssl.SSLHandshakeException: Invalid ECDH ServerKeyExchange signature executing a SMP/E Receive Order

Products

• NetMaster Network Management for TCP/IP
• Common Services
• COMMON SERVICES FOR Z/OS

Issue/Introduction

SMP/E Receive Order job fails due to the following error:

GIM69207S ** RECEIVE PROCESSING HAS FAILED BECAUSE THE CONNECTION WITH THE SERVER FAILED.  
             javax.net.ssl.SSLHandshakeException: Invalid ECDH ServerKeyExchange signature 

Environment

All the Broadcom MF products enabled for Receive Order

Cause

Missing ESM (External Security Manager) access authorizations but there are no messages on the Receive Order joblog. However, on the zOS SYSLOG only, messages like the following ones can be found (when ESM is RACF):

M 00A0000 SYS1     24127 10:25:47.49STC50611 00000090  ICH408I USER(userid ) GROUP(group  ) NAME(xxxxxxx   ) 627
D                                         627 00000090    CSFPKI CL(CSFSERV )
D                                         627 00000090    INSUFFICIENT ACCESS AUTHORITY
E                                         627 00000090    ACCESS INTENT(READ   )  ACCESS ALLOWED(NONE   )

Resolution

Provide the correct ESM authorizations to the user related to the Receive Order job.

Here is an example for RACF:

PERMIT CSFPKI CLASS(CSFSERV) ID(userid) ACCESS(READ)
PERMIT CSFDSV CLASS(CSFSERV) ID(userid) ACCESS(READ)

SETROPTS RACLIST( CSFSERV  ) REFRESH

For Top Secret, see CSFSERV Resource Class—Secure ICSF CSFSERV

For ACF2, see Integrated Cryptographic Service Facility