Common IBM Global Security Kit (GSKit) errors

• The password to access the key file is incorrect.
• Db2 does not have the correct permissions to access the password stash file, if a password stash file is being used.
  Note: The fenced user requires permissions to access the password stash file if fenced mode applications or federation wrappers make outbound connections.
• The password stash file was created with an incompatible version of IBM Global Security Kit (GSKit).
  Note: GSKit version 8.0.50.69 (and higher) generates a password stash file that older versions of IBM Global Security Kit (GSKit) cannot read. If you believe that this scenario might apply, try recreating the stash file with the current IBM Global Security Kit (GSKit) version.

• A Db2 client or a server attempting to access a keystore does not have the correct firewall access.
• A Db2 client with TLS enabled is attempting to connect to a server on a port that does not have TLS enabled.
• A Db2 client that does not have TLS enabled is attempting to connect to a server on a port that has TLS enabled.

• You are using self-signed certificates and the certificate is missing.
• The certificate that is being used is from a local certificate authority that does not have the Basic Constraints extension active.
  Note: You can use the ALLOW_NONCRITICAL_BASIC_CONSTRAINT keystore configuration parameter to bypass this problem.
• You are using CA-signed certificates, and the CA root certificate is missing.
• The client does not support Server Name Indication (SNI), and the server environment requires SNI to route TLS connections to the correct endpoint. Upgrade the client to Db2 11.5.7 or later if the server relies on SNI.
• One of the certificates in the chain is expired.

Resolving a IBM Global Security Kit (GSKit) 414 error

You can resolve a 414 error by addressing the following items:

1. Ensure that the expected certificate chain is being returned by the server. This can be achieved outside of Db2 using a tool like OpenSSL:

   openssl s_client -connect <hostname>:<port> -showcerts

   If the expected certificate is not being returned, the configuration on the peer must be corrected.
2. Ensure that the client has the correct certificate to validate the certificate chain returned from step 1. The certificate in use on the client must be valid (not expired), and the subject and issuer must be the same. If the server uses a self-signed certificate, the certificate in use on the client must match the certificate returned by the server. If the server uses a CA-signed certificate, contact the CA to determine which certificate to use.
   If the certificate on the client is contained within a key database, use IBM Global Security Kit (GSKit) to inspect the certificate details:

   gsk8capicmd_64 -cert -details -label <certificate label> -db /path/to/cert.p12 -stashed 

   If the client is using a bare certificate file, use either IBM Global Security Kit (GSKit) or OS tools like OpenSSL to inspect the certificate:

   gsk8capicmd_64 -cert -details -file /path/to/cert.pem openssl x509 -in /path/to/cert.pem -noout -text 

• If a Db2 client returns this error code, inspect the diagnostic log on the server.
• If a Db2 server returns this error code, inspect the diagnostic log on the client.

• If a Db2 client returns this error code, inspect the diagnostic log on the server.
• If a Db2 server returns this error code, inspect the diagnostic log on the client.

2024-04-29-14.12.05.484863-240 I2305E611             LEVEL: Error
PID     : 653506               TID : 139969381262912 PROC : db2sysc
INSTANCE: cyrusng              NODE : 000
APPHDL  : 0-7
HOSTNAME: CyrusNg-bitdo-x86
EDUID   : 22                   EDUNAME: db2agent ()
FUNCTION: DB2 UDB, common communication, sqlccMapSSLErrorToDB2Error, probe:30
MESSAGE : DIA3604E The SSL function "gsk_secure_soc_init" failed with the
          return code "403" in "sqlccSSLSocketSetup".
DATA #1 : String, 24 bytes
GSK_ERROR_NO_CERTIFICATE
DATA #2 : String, 54 bytes
The required certificate was not received from partner

2024-04-29-14.12.05.485356-240 I2917E540             LEVEL: Error
PID     : 653506               TID : 139969381262912 PROC : db2sysc
INSTANCE: cyrusng              NODE : 000
APPHDL  : 0-7
HOSTNAME: CyrusNg-bitdo-x86
EDUID   : 22                   EDUNAME: db2agent ()
FUNCTION: DB2 UDB, common communication, sqlcctcpinit, probe:958
MESSAGE : ZRC=0x00000036=54
DATA #1 : String, 59 bytes
SSL socket setup failed. Client IP address and port number:
DATA #2 : String, 11 bytes
9.46.241.76
DATA #3 : signed integer, 4 bytes
48322

2024-04-29-14.12.05.485460-240 I3458E538             LEVEL: Error
PID     : 653549               TID : 139776162162560 PROC : db2bp
INSTANCE: cyrusng              NODE : 000
HOSTNAME: CyrusNg-bitdo-x86
FUNCTION: DB2 UDB, common communication, sqlccMapSSLErrorToDB2Error, probe:30
MESSAGE : DIA3604E The SSL function "gsk_secure_soc_init" failed with the
return code "414" in "sqlccSSLSocketSetup".
DATA #1 : String, 18 bytes
GSK_ERROR_BAD_CERT       
DATA #2 : String, 55 bytes
Incorrectly formatted certificate received from partner

2024-05-01-17.23.44.850329-240 I567374E613           LEVEL: Error
PID     : 1112225              TID : 140467605857856 PROC : db2sysc
INSTANCE: cyrusng2             NODE : 000            DB   : SAMPLE
HOSTNAME: CyrusNg-bitdo-x86
EDUID   : 58                   EDUNAME: db2hadrs.0.0 (SAMPLE)
FUNCTION: DB2 UDB, High Availability Disaster Recovery, HADR_SHARED::hshSslHandshake, probe:10245
DATA #1 : signed integer, 4 bytes
11
DATA #2 : signed integer, 4 bytes
447
DATA #3 : String, 35 bytes
GSK_ERROR_CERTIFICATE_INVALIDSIGALG
DATA #4 : String, 56 bytes
Certificate does not have a matching Signature Algorithm

• You are using a downlevel client to connect to a Db2 server version 12.1 or later.
• You are trying to connect to a KMIP server but the KMIP server does not support sending the EMS extension.
• You are trying to connect to a federated data source that does not support sending the EMS extension.

Resolving an IBM Global Security Kit (GSKit) 449:

You can either run the affected functionality in FIPS compatibility or NOFIPS security modes, or configure the TLS peer to send the EMS extension.