tracking of UPS packages

[Bruceg]

For years i have been using the basics of your tool to collect the tracking information from UPS. Today, I am receiving an error:
(GSKit) Peer not recognized or badly formatted message received.
(GSKit) An operation which is not valid for the current TLS session state was attempted.

Has anyone run into this before? This has been working for a long time where I pass in tracking numbers and in return I get the complete delivery info from UPS. I don't think there was a change in our system. I wonder if there is something within UPS that is causing this or could internet explorer account for the error?

Any help would be greatly appreciated.

Bruce

[Scott Klement]

First let me explain some terms:

• GSKit is short for "Global Security Kit", and is the component of the IBM i operating system that HTTPAPI uses to perform TLS (aka SSL) communications.
• TLS is short for Transport Layer Security. TLS replaced SSL many years ago, but mostly people always still use the term SSL. (Very similar to how people still call our platform "AS/400", despite that the actual AS/400 hasn't produced in 22 years. People also call it SSL despite that TLS replaced it some 20 years ago.)
• Peer refers to the computer and application that you are communicating with. In this case, UPS's HTTP server.
• Message, of course, is a very common word. But in this context, it's referring to the TLS message used to exchange encrypted details.

So with that in mind, the problem is "Peer not recognized or badly fomratted message received." This translates to "UPS sent some TLS/SSL communications that we didn't understand."

Most likely UPS updated their server to use the latest and greatest version of TLS, but you are still using an older version of HTTPAPI (and maybe also have old versions of SSL/TLS configured on your system?) For example, perhaps HTTPAPI is trying to speak TLS 1.0, and UPS is requiring TLS 1.2 or newer?

That's just a guess, but would be the most common problem.

I don't understand the comment about "internet explorer". You are using HTTPAPI to communicate with UPS, correct? What does Internet Explorer have to do with the price of tea in china?

[Bruceg]

I was just guessing as to what the problem could be. Your suggestion about the old version of HTTPAPI is most likely the reason. I am using the version you created with your examples with (example16) years ago the version I'm using is in library LIBHTTP if that helps . UPS must have made a change beginning today , as things worked perfectly yesterday. I am sure we are at a TLS level compatible with UPS as we no longer use host access but TLS to send our PLD transactions. Do you have any idea where I can go to get the newest version of HTTPAPI?

Your help is really appreciated

Thanks
Bruce

[jonboy49]

https://www.scottklement.com/httpapi/

[Bruceg]

Thanks i re downloaded the library , deleted my old LIBHTTP , restored the downloaded version recompiled the program I have been using but, unfortunately I get the same results.

CALL MSR123B
(GSKit) Peer not recognized or badly formatted message received.
(GSKit) An operation which is not valid for the current TLS session state
was attempted.

[Scott Klement]

I would recommend connecting with a tool that will let you analyze the TLS version and ciphers that are being used. For example, a web browser, or a tool like the openssl command-line tool.

Then verify that this version and cipher are configured in your IBM i system values.

[Bruceg]

Thanks for your help

Bruce

[Bruceg]

In the event anyone else has this issue. I have been using this URL for years :http_url_post_xml('https://wwwcie.ups.com/ups.app/xml/Track'. I changed it to http_url_post_xml('https://onlinetrack.ups.com/ups.app/xml/Track' .

With this change my program now works as it did before . Correct me if I am wrong but wwwcie was the test URL and maybe UPS decided to sunset that one. As I mentioned this was running fine until April 1.

Bruce

[Scott Klement]

Honestly, I have no idea what the correct UPS url would be. This should be determined from UPS's documentation.

The example that I provided worked when I wrote it (about 15 years ago.) But was indeed aimed at UPS's testing server. The assumption would be that you'd start by writing your own program against the test server, and would switch it over to the production server once you were done testing things.

I've since switched jobs and no longer work with anything related to UPS, so the whole process may have changed in the interrim.