IT26545: CLIENT TO CLIENT PROXY COMMUNICATION FAILING WITH ANS1579E AND GSK_ERROR_BAD_DATE

APAR status

• Closed as program error.

Error description

• Error messages seen in the dsmerror.log of the client :
  ANS1579E GSKit function gsk_secure_soc_init failed with 401:
  GSK_ERROR_BAD_DATE
  and
  ANS1592E (RC-362) Failed to initialize SSL protocol.
  
  This is seen for nodes using client to client communications in
  proxy configurations especially for GUI interfaces which will
  display errors.
  For example, the node validation in the configuration tab of the
  Spectrum Protect for virtual Environments - Data Protection for
  VMware GUI will display the message :
  ANS1017E (RC-50) Session rejected: TCP/IP connection failure
  
  The reason is that the client certificate used for client to
  client SSL communications is expired and was not automatically
  renewed.
  Communications to the Spectrum Protect server are not affected
  as different certificate is used and therefore restore
  operations or backups (manual or scheduled) are not affected as
  long there is no client to client communication involved.
  
  Products affected:
  IBM Spectrum Protect Backup-Archive Client version 7.1 and 8.1
  on Linux x86 and Microsoft Windows x64 platform.
  IBM Spectrum Protect for Virtual Environments: Data Protection
  for VMware version 7.1 and 8.1 on Microsoft Windows x64 and
  Linux x86_64 platforms.
  IBM Spectrum Protect for Virtual Environments: Data Protection
  for Microsoft Hyper-V version 7.1 and 8.1 on
  Microsoft Windows x64 platform.
  
  If you are using Backup-Archive Client 7.1 and 8.1,
  refer to APAR IT26545
  
  Note 1: The Backup-Archive Client is a prerequisite to using the
  Data Protection for VMware version 7.1.
  In Data Protection for VMware environments, the Backup-Archive
  Client is also known as the data mover.
  
  Note 2: The Backup-Archive Client is a prerequisite to using the
  Data Protection for Microsoft Hyper-V versions 7.1 till 8.1.2.
  In Data Protection for  Microsoft Hyper-V environments,
  the Backup-Archive Client is also known as the data mover.
  
  If you are using Data Protection for VMware 8.1,
  refer to APAR IT27761
  
  If you are using Data Protection for Microsoft Hyper-V
  8.1.4-8.1.6, refer to APAR IT26846
  
  | MDVREGR - 8.1.2.0 5698ISMCL |
  
  
  
  Initial Impact: Medium
  
  Additional Keywords: tdp4ve tsm4ve proxy tdp exchange sql
  TS001284545 0732283
  

Local fix

• Renew the client nodes certificates manually as per this tech
  note : http://www.ibm.com/support/docview.wss?uid=ibm10732283
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect API and Backup-Archive Client version   *
  * 7.1 & 8.1 on Linux and Microsoft Windows x64 platform.       *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * see ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is projected *
  * to be fixed in API and Backup-Archive client level 8.1.7     *
  * Note 1: This is subject to change at the discretion of IBM.  *
  ****************************************************************
  *
  

Problem conclusion

• The code has been fixed and  SSL certificate will be renewed in
  case of expiration.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IT26846 IT27761

Modules/Macros

• dsmcad   API
  

Fix information

• Fixed component name

  TSM CLIENT

• Fixed component ID

  5698ISMCL

Applicable component levels

• R81L PSY

     UP

• R81W PSY

     UP