eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Digital Certificate SupportNote: Include single quotes if specifying more than one value with KEYUSAGE.For example:KEYUSAGE('HANDSHAKE DATAENCRYPT')LABLCERT—Specifies an optional and case-sensitive label to be associated withthe certificate being added to the user. Up to 32 characters can be specified forthe label name. Spaces are allowed if you use single quotes. This label is used asa handle instead of the serial number and issuer's distinguished name, and mustbe unique for the individual user. If a label is not specified, the label field willdefault to the value specified within the DIGICERT keyword.NADATE/NATIME—The optional NADATE and NATIME keywords specifythe effective dates and times to not be used in the digital certificate. TheNADATE specifies the “not after” date after which a digital certificate cannot beused. The NATIME specifies the “not after” time after which the certificatecannot be used. The certificate is deactivated after this date and time.An example for the NADATE/NATIME command follows:TSS GENCERT(user1) DIGICERT(cert0001) DCDSN(user1.cert.data)NADATE(09/01/03) NATIME(00:00:01)Date and time fields are optional, except if time is specified, date is required. IfNADATE is omitted, the default is one year from the date the certificate isgenerated.NBDATE/NBTIME— The optional NBDATE and NBTIME keywords specifythe effective dates and times to be used in the digital certificate. The NBDATEspecifies the “not before” date which a digital certificate can be used. TheNBTIME specifies the “not before” time which the certificate can be used. Thecertificate is activated at the specified date and time.An example for the NBDATE/NBTIME command follows:TSS GENCERT(user1) DIGICERT(cert0001) DCDSN(user1.cert.data)NBDATE(09/01/02) NBTIME(08:00:01)Date and time fields are optional, except if time is specified, date is required.SIGNWITH—Specifies the certificate with a private key that is signing thecertificate. If not specified, the default is to sign the certificate with a private keyof the certificate that is being generated. This creates a self-signed certificate. IfSIGNWITH is specified, it must refer to a certificate that has a private keyassociated with it. If no private key is associated with the certificate, aninformational message is generated and processing stops. If DCDSN is specifiedon the GENCERT command, the SIGNWITH keyword is required.Self-signed certificates are always trusted, while all other certificates are createdwith the trust status of the certificate specified in the SIGNWITH keyword. If thecertificate specified in the SIGNWITH keyword is not trusted, an informationalmessage is issued, but the certificate is still generated.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–59