03353084: ICSF callable service returned an error.
Explanation: An ICSF callable service that is employed to facilitate a cryptographic process returned an error condition. This error can occur (but not limited to) for these reasons:
- The user ID of the application does not have appropriate access to the RACF class resource profiles
for the operation that is being attempted. - Other ICSF callable service cryptographic errors can occur such as the encryption and decryption keys being
out of sync between the local application and the remote partner.
EG
permit * CLASS(CSFSERV) id(STCMQ) ACC(READ)
permit * CLASS(CSFSERV) id(COLIN) ACC(READ)
permit * CLASS(CSFSERV) id(IBMUSER ) ACC(READ)
SETROPTS RACLIST(CSFSERV) refresh
Looking at the GSKTRACE this gave me
ERROR crypto_ec_token_private_key_sign(): ICSF service failure: CSFPPKS retCode = 0x8, rsnCode = 0x2b00
ERROR crypto_sign_data(): crypto_ec_sign_data() failed: Error 0x03353084
EXIT gsk_sign_data(): <— Exit status 0x03353084 (53817476)
The return code 0x2b00 (from here) gives:
User action: You might need to re-create the token by using the PKA key token build or PKA key import callable service or regenerate the key values on another platform.
I was using an EC certificate, but AMS only supports RSA certificate. I defined a new certificate with
RACDCERT ID(COLIN ) GENCERT -
SUBJECTSDN(CN('COLIN') O('AMS') C('TEST')) -
WITHLABEL('AMS') SIGNWITH(CERTAUTH LABEL('COLIN-CA')) -
KEYUSAGE(HANDSHAKE DATAENCRYPT DOCSIGN)
RACDCERT ID(COLIN ) ALTER (LABEL('AMS')) TRUST
which defaults to RSA, and it got past this problem.