SSL Certificate Handshake Error

Products

• ACF2 - z/OS

Issue/Introduction

Receiving Certificate error messages  EZD1287I TTLS Error RC:  8 Initial Handshake 482 and Description= Self-signed certificate not found in trusted key source          

Environment

Product: ACF2

Cause

There were few expired Certificates which were deleted. 

Resolution

The Security team did delete some expired certificates but did miss to issue below commands:

F ACF2,REBUILD(USR),CLASS(P)
F ACF2,OMVS

Issuing the rebuild commands resolved the problem.  

There are some records that ACF2 dynamically updates the user profile tables on the system where the command was issued. For a table of when a refresh command is needed or not, please review the  ACF2 documentation section USER Profile Records. If you want to avoid confusion then you should always issue the command as it won't hurt.

In order to avoid potential issues on both the local and shared system, it is recommended to always perform the appropriate ACF REBUILD commands after any certificate or keyring related changes to assure that all of the changes are activated, as well as AT-TLS UPDATE or REFRESH commands.

For Example:

Renew a digital certificate:

F ACF2,REBUILD((typecode)   command to refresh your active copy of the rule.
F ACF2,REBUILD(USR),CLASS(P)
F ACF2,OMVS

 

For Policy Agent rules or profiles:

F PAGENT,REFRESH

F PAGENT,UPDATE