PM90438: SSL RETURN CODE 450, DFHWB0732 SOCKET I/O ERROR WHILE RECEIVING CLIENT REQUEST, AND DFHSO0002 X'080C'.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When a certificate error for a GSK_ERR_BAD_MSG_LEN is received,
  CICS Web services is issuing a DFHSO0002 message with a error
  code x'080C' and a dump is generated.
  
  There are two APAR's for CICS TS Ver.3.2 and 4.1 (PM60971 and
  PM53329), already includes in CICS TS Ver.4.2 base code, that
  fixes a very similar problem, but only for error codes 438,
  439, 440 and 441.
  
   The same behaviour should be followed also for error 450
  (GSK_ERR_BAD_MSG_LEN), because this is a error provoked by the
  client, and only a message DFHSO0123 is needed and CICS should
  not take a Dump if this error code 450 is encountered.
  

Local fix

• No local fix
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHSO0002 is issued while an SSL        *
  *                      handshake fails with                    *
  *                      GSK_ERR_BAD_MSG_LEN.                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The customer is using SSL with client authentication. A client
  connects to CICS and supplies its certificate as part of the
  handshake. The incorrect message length in certificate caused
  socket initialization process failed with GSK_ERR_BAD_MSG_LEN.
  GSK_ERR_BAD_MSG_LEN is handled to issue a severe error DFHSO0002
  It is considered a too strong response and DFHSO0123 should be
  issued for this kind of error.
  Additional Keywords: MSGDFHSO0002,DFHSO0002
  

Problem conclusion

• DFHSOSE has been change to handle GSK_ERR_BAD_MSG_LEN and issue
  DFHSO0123 message instead. Message template of DFHSO0123 has
  also been changed to handle this error.
  
  This apar has amended the following message:
    DFHSO0123
  
    A new message description in the
    CICS Transaction Server for z/OSVersion 5 Release 1
    CICS Messages and Codes Vol 2 SRL GC34-2862-00
    Change the line "Server name not recognized}." to
    "Server name not recognized | Bad message length}."
  
  After "43=Server name not recognized", add a new line
  "44=Bad message length".
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

• ž**** PE13/11/14 FIX IN ERROR. SEE APAR PI05993  FOR DESCRIPTION
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PM88467

• APAR is sysrouted TO one or more of the following:

  UK96567

Modules/Macros

• DFHMESOC DFHMESOE DFHMESOK DFHSOSE
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R800 PSY UK96567

     UP13/08/15 P F308

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.