z/OS FTP PROXY OPEN support over TLS

We've recently started to enforce TLS encryption for z/OS FTP connections. 

Some of our jobs use the FTP "proxy" command to request that a dataset be transferred from one z/OS FTP server to another z/OS FTP server. However, when this is done after enabling TLS on the primary connection the FTP client reports the following messages:

EZA2917I PROXY OPEN is not supported with security mechanisms
EZA1735I Std Return Code = 10000, Error Code = 00007 

Some sample JCL to reproduce the issue is as follows:

//* Transfer file myuser.job.cntl($ll) on host fromhost
//* to file myuser.vb255.data($junk) on host tohost
//STEP1 EXEC PGM=FTP,PARM='(EXIT' 
//NETRC DD DISP=SHR,DSN=&SYSUID..NETRC 
//SYSFTPD DD DISP=SHR,DSN=SYS1.TCPPARMS(myclient)
//SYSPRINT DD SYSOUT=* 
//OUTPUT DD SYSOUT=* 
//INPUT DD * 
fromhost
ebcdic 
site ispfstats 
proxy open tohost
proxy ebcdic 
proxy site ispfstats 
proxy get 'myuser.job.cntl($ll)' 'myuser.vb255.data($junk)'
quit 
/* 

...and the myclient member contains (among other things):

SECURE_MECHANISM TLS 
TLSMECHANISM ATTLS 
SECURE_FTP ALLOWED 
SECURE_CTRLCONN PRIVATE 
SECURE_DATACONN PRIVATE 
SECURE_HOSTNAME OPTIONAL
TLSTIMEOUT 600 
TLSPORT 0 
TLSRFCLEVEL RFC4217 
SSLV3 FALSE 



Is there a way to make the proxy FTP command work when the primary connection is protected by TLS? I don't understand why the proxy connection cannot also be protected by TLS and have it work the same way as an unprotected connection. I imagine that the proxy FTP host would need to also establish a TLS connection to the primary FTP host in order to keep all of the traffic protected.


The main benefit from implementing this support is that the ftp proxy commands work regardless of whether the connections are encrypted by TLS.