DFHSO0123 Return code 402 - No common ciphers negotiated

Troubleshooting

Problem

SSL handshake is failing with message DFHSO0123 Return code 402, No common ciphers negotiated. You have created a URIMAP for an outbound connection to a Server. CICS Transaction Server for z/OS (CICS TS) is acting as the Client. Your URIMAP is using the default cipher list CICS uses when ENCRYPTION=STRONG or equivalent MINTLSLEVEL=TLS10 is coded within the system initialization table (DFHSIT). Those ciphers are 35, 38, 39, 2F, 32, 33, 0A, 16, 13, 15, 12.

Symptom

The trace shows the handshake beginning with a client hello being sent outbound to the Server:

 |> x'16' at offset x'0' is handshake
            |> x'01' at offset x'5'  is client hello
 16030100 43010000 3F030158 3C71E3AB 0A078434 77705C38 8824A3FA 7212F35E
 33A6075C 53472B01 E78FB300 001800FF 00350038 0039002F 00320033 000A0016
 00130015 00120100          | 
                            |> x'0018' at offset x'2C' is the start of the ciphers

x'0018' is the Length, the x'00FF' is a TLS indicator, followed by the actual ciphers CICS supports. These are listed as 4 byte cipher values from the 0035 up to and including the 0012.

All CICS receives in the response from the Server is 15030100020228 which ends up reported back to CICS as no ciphers. This is indication the CICS default list of ciphers does not contain a cipher compatible with the remote Server.

Cause

The Server is using a higher level of encryption, thus does not make use of one of the default ciphers associated with ENCRYPTION=STRONG or MINTLSLEVEL=TLS10, which set the level of TLS to 1.0 only.

Resolving The Problem

Code MINTLSLEVEL=TLS11 (equivalent to ENCRYPTION=ALL) within the SIT, which allows for the use of TLS version 1.1 and 1.2 in addition to the protocols allowed by STRONG. Then the handshake will succeed because the Server will have have a common cipher.

Note:

As documented in topic Changes to externals in CICS TS 5.3, the ENCRYPTION SIT parameter was deprecated in CICS TS 5.3. So, you must use the MINTLSLEVEL system initialization parameter.
As documented in topic Changes to SIT parameters, the MINTLSLEVEL default value changed from TLS10 to TLS12 in CICS TS 5.5, and TLS10 and TLS10ONLY values were removed in CICS TS 6.1.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB70","label":"Z TPS"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSGMGV","label":"CICS Transaction Server"},"ARM Category":[{"code":"a8m0z00000007YsAAI","label":"Security"}],"ARM Case Number":"","Platform":[{"code":"PF035","label":"z\/OS"}],"Version":"5.4.0;5.5.0;5.6.0"}]

Product Synonym

CICS/TS CICSTS CICS TS CICS Transaction Server

Was this topic helpful?

Document Information

Modified date:
05 January 2026

UID

dwa1324292

Tips