eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

Digital Certificate SupportAn example for the SIGNWITH keyword follows:TSS GENCERT(USER01) DIGICERT(CERT0001) DCDSN(USER1.CERT.DATA) -SIGNWITH(USER02,CERT002)Listing Digital Certificate InformationTo list information about a digital certificate, identify the digital certificate by itscertificate name or label, or by both its serial number and the issuer'sdistinguished name, or by segment data. The syntax follows:TSS LIST(acid|CERTAUTH|CERTSITE) {LABLCERT('label name')}{DIGICERT(8-byte name)}{SERIALNUM(serial-number) ISSUERDN(issuer's DN)}{SEGMENT(certdata)}{SEGMENT(ALL)}{KEYRING(8-byte name)}{LABLRING(237-byte name)}For each certificate, the list command displays the following information:■■■■■■■■■■■serial numberissuer's distinguished namelabelstatusvalidity datesprivate key size (If private key is present)private key type (If private key is present)rings (If private key is present)keyusagealtnamesubject's name as found in the certificate itself, up to 256 bytesYou can list all the acids and the digital certificates associated with them byexecuting the following command:TSS LIST(SDT) DIGICERT(ALL)You can list all the acids and their keyrings associated with them by executingthe following command:TSS LIST(SDT) KEYRING(ALL)1–60 Cookbook

Digital Certificate SupportYou can list the associated SEGMENT information for a specific ACID byexecuting the following command:TSS LIST(USER01) SEGMENT(CERTDATA)TSS LIST(USER01) SEGMENT(RINGDATA)TSS LIST(USER01) SEGMENT(ALL)You can list the associated DIGICERT for a specific acid by executing thefollowing command. The command must contain the name of the DIGICERT orKEYRING already associated with the ACID.TSS LIST(USER01) DIGICERT(CERT001)orTSS LIST(USER01) KEYRING(ACCTRING)Generating a Certificate RequestYou can send a request to a certificate authority to verify the validity of a digitalcertificate. If eTrust CA-Top Secret generated the certificate, the request isimported to eTrust CA-Top Secret just as if the certificate authority was anothercompany.The request contains the subject's distinguished name and public key and issigned with the private key associated with the specified certificate. A PKCS#10base64-encoded request is generated and written to data set. The GENREQDCDSN must not be defined. Meaning the output DCDSN cannot be allocatedor cataloged, this happens when you use the GENREQ command. The data setcan be used as the DCDSN in a TSS GENCERT command.The syntax for the GENREQ command requires the DCDSN, and that youidentify the certificate using DIGICERT or LABLCERT (or both).TSS GENREQ(acid|CERTAUTH|CERTSITE) DCDSN(output data set name){DIGICERT(name)}or{LABLCERT('label name')}An example for the GENREQ command follows:TSS GENREQ(user1) DIGICERT(cert0001) DCDSN(USER3.CERT.DATA) LABLCERT(‘REQUEST 3’)ACID—A user acid or you can specify,CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (CA). This acid ispre-defined in Top Secret or you can specify. You cannot add a KEYRING to thisACID.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in Top Secret. You cannot add a KEYRING tothis ACID.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–61

Digital Certificate SupportYou can list the associated SEGMENT in<strong>for</strong>mation <strong>for</strong> a specific ACID byexecuting the following comm<strong>and</strong>:TSS LIST(USER01) SEGMENT(CERTDATA)TSS LIST(USER01) SEGMENT(RINGDATA)TSS LIST(USER01) SEGMENT(ALL)You can list the associated DIGICERT <strong>for</strong> a specific acid by executing thefollowing comm<strong>and</strong>. The comm<strong>and</strong> must contain the name of the DIGICERT orKEYRING already associated with the ACID.TSS LIST(USER01) DIGICERT(CERT001)orTSS LIST(USER01) KEYRING(ACCTRING)Generating a Certificate RequestYou can send a request to a certificate authority to verify the validity of a digitalcertificate. If <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> generated the certificate, the request isimported to <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> just as if the certificate authority was anothercompany.The request contains the subject's distinguished name <strong>and</strong> public key <strong>and</strong> issigned with the private key associated with the specified certificate. A PKCS#10base64-encoded request is generated <strong>and</strong> written to data set. The GENREQDCDSN must not be defined. Meaning the output DCDSN cannot be allocatedor cataloged, this happens when you use the GENREQ comm<strong>and</strong>. The data setcan be used as the DCDSN in a TSS GENCERT comm<strong>and</strong>.The syntax <strong>for</strong> the GENREQ comm<strong>and</strong> requires the DCDSN, <strong>and</strong> that youidentify the certificate using DIGICERT or LABLCERT (or both).TSS GENREQ(acid|CERTAUTH|CERTSITE) DCDSN(output data set name){DIGICERT(name)}or{LABLCERT('label name')}An example <strong>for</strong> the GENREQ comm<strong>and</strong> follows:TSS GENREQ(user1) DIGICERT(cert0001) DCDSN(USER3.CERT.DATA) LABLCERT(‘REQUEST 3’)ACID—A user acid or you can specify,CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (<strong>CA</strong>). This acid ispre-defined in <strong>Top</strong> <strong>Secret</strong> or you can specify. You cannot add a KEYRING to thisACID.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in <strong>Top</strong> <strong>Secret</strong>. You cannot add a KEYRING tothis ACID.Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–61

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!