Re: IBM SSL errors (was Re: PASE for i ended for signal 6, error code 1.)

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

Peter,

I don't think the problem you're experiencing is in GSKit. Rather, it is 
in the IBM crypto routines that both GSKit and the SSL APIs call. People 
have been reporting a plethora of problems with SSL in 7.1 since IBM 
added support for TLS 1.1 and 1.2.

There are far fewer complaints with 7.2/7.3, if that helps.

Node.js and most other PASE-based programs do not use the IBM crypto, 
but instead use the open source OpenSSL toolkit.

I could potentially write code in HTTPAPI to make it use OpenSSL as 
well, which would surely eliminate the problem. But, this would take a 
lot of my time, and I'm not sure it's worth it, since 7.2/7.3 work so 
much better.

As usual, though, Open Source software (OpenSSL) is much more robust and 
better supported than commercial (IBM crypto, GSKit, SSL APIs, etc).

-SK



On 11/21/2016 6:02 PM, Peter Connell wrote:
> Thanks Scott,
>
> No, we've not experienced any handshake problems at V7R1 on incoming HTTP requests to the Apache server.
> Just outgoing via GSK apis. So I'm no wiser.
>
> I didn't realize that IBM appears to support Node given that they now supply the folder /QOpenSys/QIBM/ProdData/Node
> It appears that quite a simple node JS script can avoid the GSK errors.  Just can't compile it into RPGLE like GSK.
>
> Cheers, Peter