IBM Support

ZWESVUSR ERROR (o.z.a.c.s.CustomAuthenticationProvider,CustomAuthenticationProvider.java:54) authenticate javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake Caused by: java.io.EOFException: SSL peer shut down incorrectly

Troubleshooting


Problem

Upgraded to Zowe 1.9 and are seeing the following problem:
Using Zowe Desktop for the first time, and noticed that when we try to use the UNIX System Services, MVS, or JES Explorer, a window pops up requesting the user ID and password. We specify the correct ID and password, and nothing happens, but the window pops up for the user ID and password again.
Then, I looked into the logs and noticed every time we attempt, we receive this message:
ZWESVUSR ERROR (o.z.a.c.s.CustomAuthenticationProvider,CustomAuthenticationProvider.java:54) authenticate javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
Caused by: java.io.EOFException: SSL peer shut down incorrectly

Symptom

When we try to use the UNIX System Services, MVS or JES Explorer, a window pops up requesting the user ID and password. We specify the correct ID and password, and nothing happens, but the window pops up for the user ID and password again.

Cause

The problem is caused by TLS.

Resolving The Problem

By default, z/OSMF is configured with this value IZU_SSL_PROTOCOL=SSL_TLSv2. But if a user wants to disable the usage of deprecated protocols like SSLv2, SSLv3, TLSv1.0, TLSv1.1, and configure the z/OSMF with this option: IZU_SSL_PROTOCOL=TLSv1.2, the api-common throws error:

<ZWEEAD1:https-jsse-nio-8547-exec-6:65796> ZWESVUSR ERROR (o.z.a.c.s.CustomAuthenticationProvider,CustomAuthenticationProvider.java:54)
javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
.At com.ibm.jsse2.av.a(av.java:841)
.At com.ibm.jsse2.av.i(av.java:136)
.At com.ibm.jsse2.av.a(av.java:1001)
.At com.ibm.jsse2.av.startHandshake(av.java:991)
.At org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:396)
.At org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)
....
Caused by: java.io.EOFException: SSL peer shut down incorrectly
We have a potential solution for this issue for now. We would suggest modifying the following two files and add the new system property:
-Dcom.ibm.jsse2.overrideDefaultTLS=true \
1- ROOT_DIR/components/files-api/bin/start.sh
2- ROOT_DIR/components/jobs-api/bin/start.sh
A good place to add this property is after property -Dserver.compression.enabled=true \
Then, restart Zowe.

FYI: This change is not necessary after Zowe 1.11.0 release.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSVHRS","label":"IBM Z Distribution for Zowe"},"ARM Category":[],"Platform":[{"code":"PF035","label":"z\/OS"}],"Version":"Zowe 1.9","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}}]

Document Information

Modified date:
20 April 2020

UID

ibm16195417

Page Feedback