Message
SYSERR :001: plfm_kernel_init: socket(INET, DGRAM, 0), failed, errno=EDC5112I Resource temporarily unavailable., errno2=74610296
OBJERR :001: init_PEP_and_kernel: Kernel initialization failed for image ‘TCPIP2’,
RACF profile EZB.INITSTACK.*.TCPIP2 CLASS(SERVAUTH) was missing.
//S1 EXEC PGM=IKJEFT01,REGION=0M
//STEPLIB DD DISP=SHR,DSN=SYS1.MIGLIB
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *
RDEFINE SERVAUTH EZB.INITSTACK..TCPIP2 PERMIT EZB.INITSTACK..TCPIP2 CLASS(SERVAUTH)
ID(START1) ACCESS(READ)
SETROPTS RACLIST(SERVAUTH) REFRESH
/*
WARNING:005: ..pinit_fetch_policy_profile: Ignoring non-image config file
In my image file I had a
TTLSRule
{
…}
which is not allowed. They have to be in the TTLSConfig… file.
The error message was
WARNING:005: ..pinit_fetch_policy_profile: Ignoring non-image config file ‘TTLSRule’ statement
402 No SSL cipher specifications.
In some situations the cipher specs default.
The message EZD1287I TTLS Error RC: 402 Initial Handshake pointed me to Cryptographic Services System Secure Sockets Layer Programming – No SSL cipher specifications. The first reason was
The client and server cipher specifications do not contain at least one value in common. Client and server cipher specifications might be limited depending on which System SSL FMIDs are installed. See Cipher suite definitions for more information. Server cipher specifications are dependent on the type of algorithms that are used by the server certificate (RSA, DSA, ECDSA, or Diffie-Hellman), which might limit the options available during cipher negotiation.
The GSK trace had GSK_CONNECT_CIPHER_SPEC(207) – C02B. Where C02B is TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
The certificate specified for the server was incompatible with this. I had Key Usage: HANDSHAKE
Key Type: NIST ECC
Key Size: 384
The one that worked had
Key Usage: HANDSHAKE
Key Type: NIST ECC
Key Size: 521
RC 416 GSK_ERR_PERMISSION_DENIED
Not authorized to access key database, PKCS #12 file, SAF key ring or z/OS PKCS #11 token.
EZD1287I TTLS Error RC: 416 Environment Master Init
ICH408I USER(START1 ) GROUP(SYS1 )
START1.TN3270.LST CL(RDATALIB)
INSUFFICIENT ACCESS AUTHORITY
ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )
Action: Give the started task userid permission to the ring.
RC 510 No acceptable key labels found
See here. The specified label was inconsistent with the client request.
The Wireshark output had a list of Cipher Suites, for example
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
In my keyring I had only ECC certificates. When I created an RSA certificate it worked (well moved on a step).
RACDCERT ID(START1) GENCERT -
SUBJECTSDN(CN('10.1.1.2') -
O('RSA2048') -
OU('SSS')) -
ALTNAME(IP(10.1.1.2))-
RSA -
SIZE(2048) -
SIGNWITH (CERTAUTH LABEL('DOCZOSCA')) -
WITHLABEL('RSA2048') -
RC: Code 515 Initial handshake
Code 515 Key share list is not valid
I got this when trying to use TLS 1.3.
You need
TTLSSignatureParms
{
ClientKeyShareGroups 0023
ClientKeyShareGroups 0024
ClientKeyShareGroups 0025
ClientKeyShareGroups 0030}
or ServerKeyShareGroup
517 No matches between elliptic curve and key share lists
Need something like
TTLSSignatureParms CPESigParms
{
CLientECurves 0023
CLientECurves 0024
CLientECurves 0025
CLientECurves 0029
ClientKeyShareGroups 0023
ClientKeyShareGroups 0024
ClientKeyShareGroups 0025
ClientKeyShareGroups 0029
}
519 Required ciphers have not been specified
I had TLS 1.3 specified, but no TLS 1.3 cipher specs.
The following TLSv1.3 worked.
V3CipherSuites TLS_CHACHA20_POLY1305_SHA256
EZD1287I TTLS Error RC: 5006 Initial Handshake
See the TCPIP diagnosis reference.
EZD1287I TTLS Error RC: 5006 Initial Handshake
5006 The connection is using a TTLSEnvironmentAction statement that failed
to initialize a System SSL environment.
- Use the syslog to determine why the System SSL environment failed to
initialize. - If the TTLSEnvironmentAction statement is in error, make the
necessary corrections. A System SSL environment is initialized for the
corrected TTLSEnvironmentAction statement and new connections use
that environment. - If a SAF configuration change is needed (such as changing a
certificate in the key ring), make the change and then update the
EnvironmentUserInstance parameter in the TTLSEnvironmentAction
statement to reflect a changed action. A System SSL environment
is initialized by using the modified RACF configuration and new
connections use that environment
I gave the started task permission to the keyring, and got this error.
When I restarted my application and it worked. I don’t know if this is relevant.
EZD1287I TTLS Error RC: 5003
RC 5003 will occur when the AT-TLS process is expecting an SSL message but receives a clear-text message.
System SSL 0x134cc000
The documentation for System SSL says
SSL error codes are defined internally to be ‘134CCxxx’, where xxx is the hexadecimal representation of the SSL error code. The range is ‘134CC001’ through ‘134CCFFF’. For example, SSL error code 414 would be ‘134CC19E’.
So xxx is 000 – which is no error. I got this using gsk_strerror(0) when there was no error!
ColinPaice 