eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

Digital Certificate SupportGenerating a Digital Certificate and Adding It to a UserThe GENCERT command gives the administrator the ability to create a digitalcertificate and potentially a public/private key pair.The DIGICERT keyword is required on the TSS GENCERT command. If bothDCDSN and SUBJECTN are specified, the SUBJECTN information overrides therequest data set name. If SUBJECTN is specified, only one of the SUBJECTN subfields is required to be entered.The syntax for the GENCERT command follows:TSS GENCERT [{CERTAUTH|CERTSITE|acid}] DIGICERT(8-byte-name)[DCDSN(request-data-set-name)\][SUBJECTN ('CN="common-name"T="title"OU="organizational-unit-name1,organizational-unit-name2"O="organizational-name"L="locality"ST="2-character-only-state-or-province"C="country"')][ALTNAME('IP=numeric-IP-address DOMAIN=internet-domain-nameEMAIL=email-address URI=universal-resource-identifier')][ICSF][KEYSIZE(key-size)][KEYUSAGE(‘HANDSHAKE DATAENCRYPT DOCSIGN CERTSIGN’)][LABLCERT(label-name)][NBDATE(mm/dd/yy) NBTIME(hh:mm:ss)][NADATE(mm/dd/yy) NATIME(hh:mm:ss)][SIGNWITH(acid,digicert)]The sub keywords of the GENCERT function specify the information that is to becontained within the certificate that is being created.ACID—A user acid or you can specify.CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (CA). This acid ispre-defined in eTrust CA-Top Secret. You cannot add a KEYRING to this acid.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in eTrust CA-Top Secret. You cannot add aKEYRING to this acid.DIGICERT—Specifies a one- to eight-character ID that identifies the certificatewith the user acid. The DIGICERT must be entered as part of all GENCERTcommands since this keyword indicates the name to be used in the digitalcertificate.An example for the DIGICERT command follows:TSS ADD(USER01) DIGICERT(DIGI0001)1–56 Cookbook

Digital Certificate SupportDCDSN(request-data-set-name)—Specifies the name of an optional data set thatcontains the PKCS#10 certificate request data. The request data set name can bethe output from a TSS GENREQ command. The request data contains the user'sgenerated public key and X.509 distinguished name. The request data must besigned, DER-encoded, and then Base64 encoded according to PKCS#10 standard.The data set must be cataloged and up to 26 characters long (8.8.8.2).If DCDSN is not specified, eTrust CA-Top Secret does not generate a key pairbecause this data set contains the user's public key. If DCDSN is specified,SIGNWITH must also be specified because the request-data-set-name (inDCDSN) does not contain a private key.An example for the DCDSN command follows:TSS GENCERT(USER01) DIGICERT(DIGI0001) DCDSN(USER01.CERTIF.001)SUBJECTN—The attributes can consist of 229 characters if it is a self-signedcertificate. Otherwise, if it is a non-self signed certificate, the maximum length is225-characters. You can use A-Z and 0-9. The only exception is ST=STATE orPROVINCE. This is a 2-digit value field. If DCDSN or SUBJECTN is notspecified, the SUBJECTN will default to the acid name field. Note: If any of thevalues contain blanks, they must be enclosed in double quotes. The completeSUBJECTN phase must be enclosed in parenthesis and single quotes.An example for the SUBJECTN command follows:TSS GENCERT(USER01) DIGICERT(DIGI0001) SUBJECTN(‘CN=”Ted User” ST=NJ’)ALTNAME—Specifies the appropriate values for the SubjectAltname extension,of which one or more values might be coded. There is no default. The followingare possible values that can be used:■■■IP—Specifies a string containing a fully qualified IP address in IPV4 dotteddecimal form, which is four decimal numbers (each number must be a valuefrom 0-255) separated by periods.For example: 203.9.102.100DOMAIN—Specifies a string containing a fully qualified internet domainname.For example: CA.COMEMAIL—Specifies a string containing a fully qualified email address.For example: david@kindgom.netImplementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–57

Digital Certificate SupportGenerating a Digital Certificate <strong>and</strong> Adding It to a UserThe GENCERT comm<strong>and</strong> gives the administrator the ability to create a digitalcertificate <strong>and</strong> potentially a public/private key pair.The DIGICERT keyword is required on the TSS GENCERT comm<strong>and</strong>. If bothDCDSN <strong>and</strong> SUBJECTN are specified, the SUBJECTN in<strong>for</strong>mation overrides therequest data set name. If SUBJECTN is specified, only one of the SUBJECTN subfields is required to be entered.The syntax <strong>for</strong> the GENCERT comm<strong>and</strong> follows:TSS GENCERT [{CERTAUTH|CERTSITE|acid}] DIGICERT(8-byte-name)[DCDSN(request-data-set-name)\][SUBJECTN ('CN="common-name"T="title"OU="organizational-unit-name1,organizational-unit-name2"O="organizational-name"L="locality"ST="2-character-only-state-or-province"C="country"')][ALTNAME('IP=numeric-IP-address DOMAIN=internet-domain-nameEMAIL=email-address URI=universal-resource-identifier')][ICSF][KEYSIZE(key-size)][KEYUSAGE(‘HANDSHAKE DATAENCRYPT DOCSIGN CERTSIGN’)][LABLCERT(label-name)][NBDATE(mm/dd/yy) NBTIME(hh:mm:ss)][NADATE(mm/dd/yy) NATIME(hh:mm:ss)][SIGNWITH(acid,digicert)]The sub keywords of the GENCERT function specify the in<strong>for</strong>mation that is to becontained within the certificate that is being created.ACID—A user acid or you can specify.CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (<strong>CA</strong>). This acid ispre-defined in <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>. You cannot add a KEYRING to this acid.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>. You cannot add aKEYRING to this acid.DIGICERT—Specifies a one- to eight-character ID that identifies the certificatewith the user acid. The DIGICERT must be entered as part of all GENCERTcomm<strong>and</strong>s since this keyword indicates the name to be used in the digitalcertificate.An example <strong>for</strong> the DIGICERT comm<strong>and</strong> follows:TSS ADD(USER01) DIGICERT(DIGI0001)1–56 Cookbook

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!