At my shop we have z/OS 3.1 and TLS 1.2 . The problem is zti connects from python 3.9 but not from 3.13 from Windows 11 systems(It works from Linux systems though). Fixed it by below code prepared with the help of Gemini.

import ssl
import sys

# 1. Force a "Legacy-Friendly" SSL Context
# We override the default context creation globally for this process
original_create_default_context = ssl.create_default_context

def mainframe_compatible_context(*args, **kwargs):
    ctx = original_create_default_context(*args, **kwargs)
    # Bypass hostname and certificate checks (common for internal gateways)
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    
    # Enable Legacy Ciphers and Lower Security Level
    # SECLEVEL=0 is the most permissive for older AT-TLS policies
    ctx.set_ciphers('DEFAULT@SECLEVEL=0')
    
    # Enable Unsafe Legacy Renegotiation (OP_LEGACY_SERVER_CONNECT = 0x4)
    # This is usually the culprit for 'handshake failure' on z/OS
    ctx.options |= 0x4 
    return ctx

# Apply the monkeypatch
ssl.create_default_context = mainframe_compatible_context

# 2. Correct Import for ibm/tnz
try:
    from tnz.zti import main
except ImportError:
    print("Error: Could not find tnz.zti. Ensure 'pip install tnz' was run for Python 3.13.")
    sys.exit(1)

if __name__ == "__main__":
    # Pass arguments directly to the zti main function
    # Usage: python zti_fix.py xx.xx.xx.xx:992
    if len(sys.argv) == 1:
        sys.argv.append('xx.xx.xx.xx:992')
    
    # Replace script name with 'zti' for the internal parser
    sys.argv[0] = 'zti'
    main()

PS C:\Users\zsuni> python .\zti_fix.py

(Request) TNZ Client Certificate Option #95

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions