MQSeries.net :: View topic

zpat · Posted: Thu Apr 29, 2021 12:02 pm Post subject:

MQ v8 introduced TLS Server Name Indication to support CERTLABL on channels.

I have a question for any z/OS MQ experts out there.

If we migrate from 7.1 to 9.0 on z/OS MQ in COMPAT 710 mode, does this SNI feature come into effect immediately or only when we move to NEWFUNC 900 mode?

(Assume the channel is sender/receiver between two z/OS QMs).

We don't use CERTLABL on any channels but we are getting some SNI errors when using TLS 1.2 ciphers.

If I switch the channel to use 3DES it will connect fine. Using TLS it goes into retry and the error code is Requested Servername not recognised (gskit rc 448) - which means the SSL handshake has failed due to SNI issues of some sort.

Is there a way to disable SNI (no CERTLABL is set on any channel) on z/OS MQ, the ESM is ACF2?

Error on start

CSQX620E +XXXX CSQXRCTL System SSL error, channel xxxxxxxxx connection yyyy (10.x.x.x) function 'gsk_secure_socket_init' RC=448
_________________
Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error.