PH05393: SSL ERROR 437 (X'1B5') CONNECTION_CLOSED USING CONNECTION POOLING IN CICS TS V5R4.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• An SSL error 437 (X'1B5') is issued, that means a notification
  is received from the peer application and the socket is closed.
  It seems this is a remote server problem, but it is only
  happening randomly when customer use connection pooling in CICS
  (SOCKETCLOSE is not zero when the URIMAP is defined). If the
  connection pooling is not used (SOCKETCLOSE(0000) in URIMAP
  definition), the problem is not appearing.
  
  Everything should be taken care of by CICS.  CICS does attempt
  to check the state of the connection before the socket is
  removed from the pool. It appears that this is perhaps not
  working correctly for SSL based sockets.
  

Local fix

• Do not use connection pooling (SOCKETCLOSE(0000))
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users                               *
  ****************************************************************
  * PROBLEM DESCRIPTION: SSL error 437 (X'1B5')                  *
  *                      Connection_Closed using connection      *
  *                      pooling with a proxy                    *
  ****************************************************************
  From CICS TS 5.4 SSL based sockets are owned by the S8 TCBs, not
  by the SO TCB as before. CICS needs to change to an S8 TCB to
  check on the state of a socket in the pool.
  With connection pooling, when a proxy server is being used, the
  initial connection to the proxy server is made without using SSL
  so CICS changes to the SO TCB. The check on the state of the
  socket in the pool is then made on the SO TCB instead of an
  S8 TCB.
  In the reported case the socket descriptor, a listener socket
  for a TCPIPSERVICE, is checked. The check passes and the closed
  socket from the pool is incorrectly selected for reuse.
  

Problem conclusion

• DFHWBCL will call DFHSOPL on the correct TCB (S8 for SSL and SO
  for non-SSL).
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI62134 UI62135

Modules/Macros

• DFHWBCL
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R100 PSY UI62135

     UP19/03/27 P F903

• R200 PSY UI62134

     UP19/03/27 P F903

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.