GSKit access - error=3027

[Paul C]

Hi Scott:

Why am I getting error=3027 with GSKit. Is this simply an authority issue?

Thanks
Paul

CPF9897 Diagnostic 40 05/30/23 14:30:30.114011 HTTPAPIR4 KBLIBHTTP *STMT HTTPAPIR4 KBLIBHTTP *STMT
From module . . . . . . . . : HTTPUTILR4
From procedure . . . . . . : UTIL_DIAG
Statement . . . . . . . . . : 5557
To module . . . . . . . . . : HTTPUTILR4
To procedure . . . . . . . : HTTP_DEBUG
Statement . . . . . . . . . : 5990
Message . . . . : Unlink debug file failed with errno=3027
Cause . . . . . : No additional online help information is available.
CPF9897 Diagnostic 40 05/30/23 14:30:30.142480 HTTPAPIR4 KBLIBHTTP *STMT HTTPAPIR4 KBLIBHTTP *STMT
From module . . . . . . . . : HTTPUTILR4
From procedure . . . . . . : UTIL_DIAG
Statement . . . . . . . . . : 5557
To module . . . . . . . . . : COMMSSLR4
To procedure . . . . . . . : SSL_ERROR
Statement . . . . . . . . . : 7936
Message . . . . : (GSKit) Access to the key database is not allowed.
Cause . . . . . : No additional online help information is available.

[Paul C]

Hi Scott:

Here is more information I got from the message log.

Unlink debug file failed with errno=3027
http_setauth(): entered
http_persist_open(): entered
http_long_ParseURL(): entered
DNS resolver retrans: 2
DNS resolver retry : 2
DNS resolver options: x'00000136'
DNS default domain: CPWM.US
DNS server found: 10.162.193.3
DNS server found: 10.162.193.7
https_init(): entered
QSSLPCL = *TLSV1.2
SSL version 2 support disabled
SSL version 3 support disabled
Old interface to TLS version 1.0 support enabled
TLS version 1.0 support enabled
TLS version 1.1 support enabled
TLS version 1.2 support enabled
TLS version 1.3 support enabled
initializing GSK environment
(GSKit) Access to the key database is not allowed.
ssl_error(6003): (GSKit) Access to the key database is not allowed.
SetError() #24: gsk_env_init: (GSKit) Access to the key database is not allowed.
http_close(): entered
HTTPAPI Ver 1.45 released 2021-09-20
NTLM Ver 1.4.0 released 2014-12-22
OS/400 Ver V7R3M0

[Scott Klement]

Yes. The number 3027 means you're getting error CPE3027 -- you can type the following at the command line:

Code: Select all

DSPMSGD CPE3027

This will tell you that 3027 means "Operation not permitted" -- in other words, it is an authority error. This error is ocurring when you call http_debug -- so it is attempting to delete the prior version of the debug log, and is failing due to insufficient authority. This message is not related to GSKit, and HTTPAPI will not stop processing for an error with the debug file, it will simply continue.

Later, you are receiving another error "(GSKit) Access to the key database is not allowed. " This is a GSKit error, and will prevent the session from working. This error means that you do not have authority to the operating system's key database that is needed to perform TLS (aka SSL) encryption. See the README member that is included with HTTPAPI for suggestions on how to fix that.