PM88467: SSL RETURN CODE 450, DFHWB0732 SOCKET I/O ERROR WHILE RECEIVING CLIENT REQUEST, AND DFHSO0002 X'080C'.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When a certificate error for a GSK_ERR_BAD_MSG_LEN is received,
  CICS Web services is issuing a DFHSO0002 message with a error
  code x'080C' and a dump is generated.
  
  There are two APAR's for CICS TS Ver.3.2 and 4.1 (PM60971 and
  PM53329), already includes in CICS TS Ver.4.2 base code, that
  fixes a very similar problem, but only for error codes 438,
  439, 440 and 441.
  
   The same behaviour should be followed also for error 450
  (GSK_ERR_BAD_MSG_LEN), because this is a error provoked by the
  client, and only a message DFHSO0123 is needed and CICS should
  not take a Dump if this error code 450 is encountered.
  

Local fix

• No local fix
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHSO0002 is issued when SSL handshake  *
  *                      fails with GSK_ERR_BAD_MSG_LEN.         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The customer is using SSL with client authentication. A client
  connects to CICS and supplies its certificate as part of the
  handshake. The incorrect message length in certificate caused
  socket initialization process failed with GSK_ERR_BAD_MSG_LEN.
  GSK_ERR_BAD_MSG_LEN is handled to issue a severe error DFHSO0002
  It is considered a too strong response and DFHSO0123 should be
  issued for this kind of error.
  Additional Keywords: MSGDFHSO0002,DFHSO0002
  

Problem conclusion

• DFHSOSE has been change to handle GSK_ERR_BAD_MSG_LEN and issue
  DFHSO0123 message instead. Message template of DFHSO0123 has
  also been changed to handle this error.
  
  This apar has amended the following message:
  DFHSO0123
  
  A new message description in the
  CICS Transaction Server for z/OS Version 4 Release 2
  CICS Messages and Codes Vol 2 SRL GC34-7176-01
  Change the line "43=Server name not recognized}" to
  "43=Server name not recognized, 44=Bad message length}".
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PM90438 UK96566

Modules/Macros

•    DFHMESOC DFHMESOE DFHMESOK DFHSOSE
  

Fix information

• Fixed component name

  CICS TS Z/OS V4

• Fixed component ID

  5655S9700

Applicable component levels

• R700 PSY UK96566

     UP13/08/15 P F308

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.