eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Digital Certificate SupportCase #2. The certificate being added is NOT a duplicate of the existing certificate,has the same subject’s distinguished name, issuer’s distinguished name, andpublic key as the existing certificate, the end date and time on the certificatebeing added is later than on that of the existing certificate, the existing certificateis NOT expired, and the record keys of both certificates are the same;Case #3. The certificate being added is NOT a duplicate of the existing certificate,has the same public key as the existing certificate, there is a private keyassociated with the existing certificate in the database, the existing certificate isNOT expired, and the record keys of both certificates are the same.An example for the REPLACE command follows:TSS REPLACE(USER01) DIGICERT(DIGI0001) DCDSN(USER1.CERT.DATA)Changing a Certificate's StatusThe trust status of a certificate can be changed for a specified user or certificateauthority. The status of the certificate is updated according to whether TRUST,NOTRUST or HITRUST is specified on the command.Important! HITRUST is only valid for the Acid named CERTAUTH.On a REPLACE command, the digital certificate that you want to update can beidentified three different ways: by using DIGICERT or LABLCERT, or by usingboth SERIALNUM and ISSUERDN.The syntax for the REPLACE command follows:TSS REP(acid|CERTAUTH|CERTSITE) {DIGICERT(name)}{LABLCERT(label name)}{SERIALNUM(serial number) ISSUERDN(issuer's dist' name)}TRUST|NOTRUST|HITRUSTAn example for the REPLACE command follows:TSS REPLACE(user1) DIGICERT(cert0001) NOTRUSTChanging a Certificate's LabelThe label for a certificate can be changed. The syntax requires that the certificatefor which the label is being updated be identified using DIGICERT or by usingSERIALNUM and ISSUERDN.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–63