Re: SSL gskit handshake errors

[Scott Klement <web400@xxxxxxxxxxxxxxxx>]

HTTPAPI calls the gsk_* functions on your behalf.  If you're using this 
callback, you'd be doing so by coding something like:

*http_xproc( HTTP_POINT_GSKIT_CERT_VAL: %paddr(myProcedure));*

I'm guessing that you're not doing that, so probably that APAR didn't 
apply to your situation.   I wonder if the API you're connecting to 
might change servers at night?  Perhaps they have a fallback server that 
they go to while doing maintenance (such as a nightly backup, etc) and 
it uses different ciphers?

I'm not sure what's going on, though, just taking guesses.  If retrying 
is enough to solve the problem, maybe that's the best solution for now.


On 11/10/2020 1:11 PM, Gerald Magnuson wrote:
> I see that a while ago (10 YEARS), I had troubles with authority to the
> certificate store, and was falling into the certification validation
> callback.
> I don't see any reference in my code to any gsk_* functions
>
> On Tue, Nov 10, 2020 at 12:52 PM Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
> wrote:
>
> > I would simply guess that no, I don't use the certificate validation
> > callback.
> >
> >
> > On Tue, Nov 10, 2020 at 12:20 PM Scott Klement <web400@xxxxxxxxxxxxxxxx>
> > wrote:
> >
> > > Seems to me that the APAR description refers to only situations where
> > > you're using the certificate validation callback.  Are you using that?
> > > In my experience, not too many people do.
> > >
> > > On 11/10/2020 8:46 AM, Gerald Magnuson wrote:
> > > > It may fix those who are using TLSv1.2, since the APAR description
> > > details
> > > > that.
> > > > I only see the errors when I use TLSv1.3 and the TLSv1.3 ciphers.
> > > --
> > > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> > > list
> > > To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: https://lists.midrange.com/mailman/listinfo/web400
> > > or email: WEB400-request@xxxxxxxxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at https://archive.midrange.com/web400.