PH54464: CUSTOMER REQUIRES CICS TO USE SHA-256 WITH RSASSA-PSS AND SHA-512 WITH RSASSA-PSS SIGNATURE ALGORITHMS.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Customer's external partner requires CICS to use SHA-256 with
  RSASSA-PSS and SHA-512 with RSASSA-PSS Signature algorithms
  We need to change CICS to set the GSK_TLS_SIG_ALG_PAIRS
  environment variable to include the 0804, 0805 and 0806
  algorithms.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users                               *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHSO0123 with insert                   *
  *                      GSK_ERR_CERT_VALIDATION,                *
  *                      indicating a partner certificate error. *
  ****************************************************************
  CICS calls a web service to a remote server using the SSL
  protocol and attempts to open a connection and establish a
  handshake. The handshake fails because the signature algorithm
  from the client certificate is not in the signature algorithms
  pairs list.
  
  This leads to the error message DFHSO0123
  GSK_ERR_CERT_VALIDATION, indicating a partner certificate error.
  

Problem conclusion

• We have updated DFHSOSE to explicitly set GSK_TLS_SIG_ALG_PAIRS
  to add in the additional algorithms (0804, 0805, and 0806).
  

Temporary fix

Comments

• ×**** PE23/12/22 FIX IN ERROR. SEE APAR PH58916  FOR DESCRIPTION
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PH53611

• APAR is sysrouted TO one or more of the following:

  UI92546

Modules/Macros

• DFHSOSK
  

Fix information

• Fixed component name

  CICS TS Z/OS V6

• Fixed component ID

  5655YA100

Applicable component levels

• R400 PSY UI92546

     UP23/06/30 P F306

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.