eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Digital Certificate SupportThe syntax for using the REPLACE command to change a label follows:TSS REPLACE(acid|CERTAUTH|CERTSITE) {DIGICERT(name)}{SERIALNUM(serial number) ISSUERDN(issuer's dist' name)}LABLCERT(label name)An example for the LABLCERT command follows:TSS REPLACE(USER01) DIGICERT(DIGI0001) LABLCERT(‘label for digicert 002’)Removing a Certificate from a UserYou can use the REMOVE command to remove a certificate from a user.If the certificate has a connection to a user key ring, the certificate is removedalong with any key ring connections it can have.On a REMOVE command, the digital certificate can be identified three differentways: by using DIGICERT or LABLCERT, or by using both SERIALNUM andISSUERDN.Use the following command to remove a certificate from a user:TSS REM(acid|CERTAUTH|CERTSITE) {DIGICERT(8-byte name)}{LABLCERT(label name)}{SERIALNUM(serial number) ISSUERDN(issuer's dist' name)}An example for the REMOVE command follows:TSS REMOVE(USER01) DIGICERT(DIGI0001)Determining if a Certificate has been Added to eTrust CA-Top SecretYou can check to see who has a certificate in a specified data set. The CHKCERTcommand determines whether the digital certificate in the specified data set hasbeen added to the eTrust CA-Top Secret security file and associated with an acid.Use the following syntax for TSS CHKCERT:TSS CHKCERT DCDSN(input data-set-name) PKCSPASS(pksc12-password)DCDSN(input-data-set-name)—Specifies the name of an optional data set thatcontains the PKCS#10 certificate request data. The request data set name can bethe output from a TSS GENREQ command. The request data contains the user'sgenerated public key and X.509 distinguished name. The request data must besigned, DER-encoded, and then Base64 encoded according to PKCS#10 standard.PKCSPASS—The PKCS-password can be up to 255 characters, is case sensitive,and can contain blanks.1–64 Cookbook