In addition to the steps for diagnosing AT-TLS problems described in z/OS Communications Server: IP Diagnosis Guide, you might need to collect a System SSL trace when you are diagnosing an AT-TLS problem. The only method for collecting this trace is by using GSKSRVR CTRACE, as described in z/OS Cryptographic Services System SSL Programming. You cannot use the GSK_TRACE environment variable because it causes an abend if it is used with AT-TLS. When you use GSKSRVR CTRACE to diagnose AT-TLS problems, the job name that you specify on the JOBNAME parameter of the CTRACE command should be the TCP/IP job name rather than the application job name.
If you are not using any other features provided by the GSKSRVR started task, then you can use the sample procedure provided in the SGSKSAMP library without any changes.