GSKIT - Peer not recognized or badly formatted message received.

[Jim_IT]

I generally try to work through whatever issue I am dealing with but this error is proving to be very difficult.

I spliced together Albert York's TNAPI program with Scott Klement's SSL code to enable 5250 screen scraping over SSL.

It works on 4 out of 5 production partitions. We are a very, very large corporation and another department creates our certificates.

On the failing partition, the message is Peer not recognized or badly formatted message received. GSKIT (gsk rc = 410)

I've used OpenSSL to get the certificate information, but not really seeing anything when querying the target server's certificates.

Jim

[Scott Klement]

Unfortunately, that error message isn't very meaningful. It basically means that GSKit didn't understand the dat that was sent to it, but it doesn't tell you why.

I've seen this before when:

1) Connecting with SSL to a non-SSL server
2) Using an SSL protocol that's not supported by the server, or when the server uses a protocol not supported by the client
3) When something is screwed up in the DCM.

But, there may be other causes, too... that's just what I remember off the top of my head.

The first thing to do is to make sure you've got the latest PTFs for your OS, including the latest Cume, HIPER and group PTFs. Also check if you're running V7R1 (or older). This release has only a partial implementation of the newer TLS versions (TLS is the new name for SSL, though everyone still calls it "SSL") and IBM has said that it will not implement better TLS on 7.1, that customers have to upgrade to 7.2 or higher for proper support.

Aside from checking those things, you'll really have to troubleshoot what's going on. (Which can be difficult, I know, when you aren't familiar with TLS/SSL internals.) Maybe IBM support would also help?