PI80519: MESSAGE DFHSO0002 RECEIVED WITH CODE 080C, BUT THE CORRESPONDINGTRACE ENTRY INDICATES "GSK_UNKNOWN_RETURN_CODE"

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• You are receiving the message:
  DFHSO0002 A severe error (code X'080C') has occurred in module
  DFHSOSE.
  
  The corresponding trace entry received shows:
  
  SO 080C SOSE  *EXC* - SYSTEM_SSL_ERROR
   GSK_RESPONSE(GSK_UNKNOWN_RETURN_CODE) FUNCTION(INITIALIZE_SSL)
   RESPONSE(DISASTER) REASON (GSK_ERROR) GSK_RETURN_CODE(335308A)
  
  The GSK_RETURN_CODE means CMSERR_KATPW_ICSF_FAILED; description:
  "The power-on known answer tests failed. Either ICSF was not
  available or FIPS mode was disabled. FIPS mode cannot be set."
  
  This GSK_RETURN_CODE should be documented in the trace, and
  consideration given to the appropriate system action and
  messaging for the event.
  

Local fix

• KIXREVRER
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All.                                         *
  ****************************************************************
  * PROBLEM DESCRIPTION: Trace point 'SO 080C' returns a         *
  *                      GSK_RESPONSE of GSK_UNKNOWN_RETURN_CODE *
  *                      for GSK Cryptographic Message Syntax    *
  *                      (CMS) error codes.                      *
  ****************************************************************
  * RECOMMENDATION: .                                            *
  ****************************************************************
  This APAR was originally raised against CICS Transaction Server
  for z/OS V5.1 but with concurrence from the customer, the fix
  for this APAR is being delivered for CICS Transaction Server
  for z/OS V5.3 and V5.4.
  
  In the reported problem, DFHSOSE was driven as part of SSL
  processing.  However, a call it made to the SSL subsystem
  returned a sub_response of 335308A indicating an error.
  DFHSOSE wrote an 'SO 080C' *EXC* trace entry to the raw trace
  dataset which contained the sub_response as a hex value.
  
  However, formatting the above SO 080C trace entry showed the
  following:
                                                                 .
  GSK_RESPONSE(GSK_UNKNOWN_RETURN_CODE)
  GSK_RETURN_CODE(335308A)
                                                                 .
  Currently, DFHSOTRI does not format a GSK_RESPONSE for a
  GSK_RETURN_CODE which is in the range:
  x'3353001' to x'33530AC' (inclusive).  Had it done so then
  it would have formatted as:
  GSK_RESPONSE(CMSERR_KATPW_ICSF_FAILED)
  

Problem conclusion

• DFHSOTRI has been amended and will now produce meaningful
  GSK_RESPONSE inserts when the GSK_RETURN_CODE is in the
  range x'3353001' to x'33530AC' inclusive.
  
  The IBM Knowledge Centre for CICS Transaction Server V5.3 and
  V5.4 will be updated with the following:
  
  Message DFHSO0123: a new REASON of 'GSKCMS Error' will be
  added at the end of the existing set of reasons.
  
  In the User response section, the sentence starting "For
  descriptions of the return code rc," will be changed to read:
  "For descriptions of the return code rc, (which is in decimal
  and may need converting to hex), see z/OS Cryptographic
  Services: System SSL Programming, SC24-5901.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI51085 UI51086

Modules/Macros

• DFHMESOE DFHSOSE  DFHSOTRI
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R000 PSY UI51085

     UP17/10/20 P F710

• R100 PSY UI51086

     UP17/10/20 P F710

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.