eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Digital Certificate SupportGeneral RulesThe following rules and procedures apply for eTrust CA-Top Secretadministrators. They must have ACID(MAINTAIN) for users within their scope,plus MISC4(authority levels). Details for authority levels of MISC4 can be foundin the Command Functions Guide. Administrators must be defined with anOMVS segment UID, Group, and Default Group to perform any digital certificatecommands and the Unix System Services (Open Edition) must be active.If the certificate is generated by the eTrust CA-Top Secret GENCERT command,it is to be used for SSL server authentication. The certificate must beexported/imported to the client’s side repository so the public key is available inorder to successfully decrypt the server’s certificate during the SSLauthentication handshake. Client software might be PC Workstation, Internetbrowser, AS400, Windows NT, MQSeries, FTPSSL, QWSSSL, etc. They also needauthority to the IBMFAC. To establish this authority, the IBMFAC must beowned:TSS ADD(tssdept) IBMFAC(IRR)Then permit to the administrator:TSS PERMIT(tssadmin1) IBMFAC(IRR.DIGTCERT.LISTRING) ACCESS(UPDATE)If the administrator submits batch scripts for Digital Certificates, they mustinclude REGION=0M in their job statement within the JCL.Third Party VendorsAny certificate obtained from third party vendors, such as Verisign, can beregistered to eTrust CA-Top Secret via the TSS ADD command. Once thecertificate is received from the vendor it must be placed into a cataloged MVSdata set so that it can be accessed by eTrust CA-Top Secret. This data set wouldthereby represent the value specified in the DCDSN keyword of the TSS ADDcommand.TSS ADD(name) DIGICERT(namecert) DCDSN(name.certificate.data) TRUSTImplementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–53