PI44136: RECEIVING DFHSO0123 RETURN CODE 446 AND DFHSO0002 X'080C' DURING SSL HANDSHAKE

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• During SSL Handshake processing, customer intermittently
  receives message DFHSO0123 reporting error code 446 -
  GSK_ERR_TLS_EXTENSION_MISMATCH.  CICS handles this as a severe
  error and produces a DFHSO0002 (code x'080C') dump. The 446
  error code indicates a client is trying to communicate with
  CICS using a higher level of TLS than is supported by this CICS
  region. In this scenario, the CICS region is running with
  ENCRYPTION(WEAK) coded in the DFHSIT which allows only the
  lowest level of TLS 1.0.
    CICS should treat this as a soft error and not produce a
  DFHSO0002 dump.
  
  
  
  Additional Symptom(s) Search Keyword(s): KIXREVDAM
         GSK ERR TLS EXTENSION MISMATCH
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHSO0002 is issued when SSL fails with *
  *                      GSK_ERR_TLS_EXTENSION_MISMATCH          *
  *                      (response code 446).                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  CICS is setup with SSL. A client connects to CICS using a higher
  level of TLS than is supported by the CICS region. This causes
  the socket initialization failed with gsk response code 446
  (GSK_ERR_TLS_EXTENSION_MISMATCH). CICS treats code 446 as a
  severe error and issues message DFHSO0123 to report it. In
  addition, DFHSO0002 is issued with a system dump.
  
  Response code 446 should be treated as a client side error,
  message DFHSO0002 and the system dump is unnecessary for this
  type of error.
  
  Additional Keywords: msgDFHSO0123 SO0123 msgDFHSO0002 SO0002
  

Problem conclusion

• DFHSOSE has been changed to only issue message DFHSO1023 with
  the correct description, when gsk returns response code 446.
  The DFHSO0002 is not issued and a system dump is not taken.
  
  CICS Transaction Server for z/OS Version 5 Release 1
  CICS Messages and Codes, GC34-2862-00 has amended
  the description of message DFHSO0123.
  
  Change the line  "Export restriction}."  to  "Export
  restriction | TLS version mismatch}."
  Change the line "46=Export restriction" to "46=Export
  restriction, 47=TLS version mismatch".
  
  CICS Transaction Server for z/OS Version 5 Release 2
  CICS Messages and Codes Vol 2, GC34-7284-00 has
  amended the description of message DFHSO0123.
  
  Change the line  "Export restriction}."  to  "Export
  restriction | TLS version mismatch}."
  Change the line "46=Export restriction" to "46=Export
  restriction, 47=TLS version mismatch".
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PI38964

• APAR is sysrouted TO one or more of the following:

  UI30069 UI30070

Modules/Macros

• DFHMESOC DFHMESOE DFHMESOK DFHSOSE
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R800 PSY UI30069

     UP15/08/21 P F508

• R900 PSY UI30070

     UP15/08/21 P F508

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.