eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

Digital Certificate SupportAdding a Digital Certificate to an ACID RecordWhen adding a digital certificate, the DIGICERT and DCDSN keywords arerequired on the TSS ADD command. All other keywords are optional.The syntax for the ADD command follows:TSS ADD(acid|CERTAUTH|CERTSITE) DIGICERT(8-byte name) DCDSN(dsname)[START(sdate)][FOR(ddd)|UNTIL(date)][LABLCERT(label name)][TRUST|NOTRUST|HITRUST][ICSF][PKCSPASS(‘PKCSPASS PASSWORD’)]ACID—A user acid or you can specify:CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (CA). This acid ispre-defined in Top Secret. You cannot add a KEYRING to this ACID.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in Top Secret. You cannot add a KEYRING tothis ACID.DIGICERT—Specifies a one- to eight-character ID that identifies the certificatewith the user acid.DCDSN—Specifies the MVS data set containing the digital certificate. The dataset must be defined as physical sequential (DSORG=PS) and variable blockeddata set (RECFM=VB). The data set name is entered as a fully qualified namewithout enclosed quotes. The data set must be cataloged and up to 26 characterlong (8.8.8.2).The certificate contained in the data set must be BER-encoded, PKCS-7BER-encoded, or Privacy Enhanced Mail (PEM)-encoded. PEM certificates mustbe transported to MVS as TEXT; the other formats must be transported asBINARY. The length of the serial number and certificate authority distinguishedname must be less than 246.An example for the DCDSN command follows:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001)START—Specifies an optional activation date. This date is not the same as theactivation date defined in the certificate itself. The web server validates that date.This date gives the security administrator the ability to specify when thecertificate will become active on MVS.An example for the START command follows:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) START(10/01/03)1–54 Cookbook

Digital Certificate SupportFOR|UNTIL—Specifies an optional expiration date. This date is not the same asthe expiration date defined in the certificate. The web server validates that date.This date gives the security administrator the ability to specify when thecertificate will expire on MVS.Examples for the FOR|UNTIL commands follow:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) FOR(30)TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) UNTIL(10/01/03)LABLCERT—Specifies the label to be associated with the certificate being addedto the user. Up to 32 characters can be specified for the label name. Spaces areallowed if you use single quotes. This label is used as an identifier instead of theserial number and issuer's distinguished name, and must be unique for theindividual user. If a label is not specified, the label field will default to the valuespecified within the DIGICERT keyword.An example for the LABLCERT command follows:TSS ADD(USER01) DIGICERT(DIGI0001) LABLCERT(‘label for digicert 001’)TRUST|NOTRUST | HITRUST—A certificate can be associated with a useronly when TRUST is specified. The default is NOTRUST.Examples for the TRUST|NOTRUST |HITRUST commands follow:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) TRUSTTSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) NOTRUSTTSS ADD(CERTAUTH) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) HITRUST ** Important! HITRUST is only valid for the Acid named CERTAUTH.ICSF—If ICSF is specified and the IBM ICSF feature is enabled,(ICSF is theinterface to the cryptographic hardware on z/OS and OS/390. You must havecryptographic hardware installed and enabled on your system) the private key isstored in the ICSF data facility.An example for the ICSF attribute follows:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER04.CERTIF.001) ICSFNote: If the certificate's private key resides in an ICSF storage facility and theformat of PKCS12DER or PKCS12B64 is specified in the TSS EXPORT command,the command is rejected and a TSS0533E message is issued.PKCSPASS—The PKCCS-password can be up to 255 characters, is case sensitive,and can contain blanks.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–55

Digital Certificate SupportFOR|UNTIL—Specifies an optional expiration date. This date is not the same asthe expiration date defined in the certificate. The web server validates that date.This date gives the security administrator the ability to specify when thecertificate will expire on MVS.Examples <strong>for</strong> the FOR|UNTIL comm<strong>and</strong>s follow:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) FOR(30)TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) UNTIL(10/01/03)LABLCERT—Specifies the label to be associated with the certificate being addedto the user. Up to 32 characters can be specified <strong>for</strong> the label name. Spaces areallowed if you use single quotes. This label is used as an identifier instead of theserial number <strong>and</strong> issuer's distinguished name, <strong>and</strong> must be unique <strong>for</strong> theindividual user. If a label is not specified, the label field will default to the valuespecified within the DIGICERT keyword.An example <strong>for</strong> the LABLCERT comm<strong>and</strong> follows:TSS ADD(USER01) DIGICERT(DIGI0001) LABLCERT(‘label <strong>for</strong> digicert 001’)TRUST|NOTRUST | HITRUST—A certificate can be associated with a useronly when TRUST is specified. The default is NOTRUST.Examples <strong>for</strong> the TRUST|NOTRUST |HITRUST comm<strong>and</strong>s follow:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) TRUSTTSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) NOTRUSTTSS ADD(CERTAUTH) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001) HITRUST ** Important! HITRUST is only valid <strong>for</strong> the Acid named CERTAUTH.ICSF—If ICSF is specified <strong>and</strong> the IBM ICSF feature is enabled,(ICSF is theinterface to the cryptographic hardware on z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390. You must havecryptographic hardware installed <strong>and</strong> enabled on your system) the private key isstored in the ICSF data facility.An example <strong>for</strong> the ICSF attribute follows:TSS ADD(USER01) DIGICERT(DIGI0001) DCDSN(USER04.CERTIF.001) ICSFNote: If the certificate's private key resides in an ICSF storage facility <strong>and</strong> the<strong>for</strong>mat of PKCS12DER or PKCS12B64 is specified in the TSS EXPORT comm<strong>and</strong>,the comm<strong>and</strong> is rejected <strong>and</strong> a TSS0533E message is issued.PKCSPASS—The PKCCS-password can be up to 255 characters, is case sensitive,<strong>and</strong> can contain blanks.Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–55

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!