eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

Digital Certificate SupportThe syntax for using the REPLACE command to change a label follows:TSS REPLACE(acid|CERTAUTH|CERTSITE) {DIGICERT(name)}{SERIALNUM(serial number) ISSUERDN(issuer's dist' name)}LABLCERT(label name)An example for the LABLCERT command follows:TSS REPLACE(USER01) DIGICERT(DIGI0001) LABLCERT(‘label for digicert 002’)Removing a Certificate from a UserYou can use the REMOVE command to remove a certificate from a user.If the certificate has a connection to a user key ring, the certificate is removedalong with any key ring connections it can have.On a REMOVE command, the digital certificate can be identified three differentways: by using DIGICERT or LABLCERT, or by using both SERIALNUM andISSUERDN.Use the following command to remove a certificate from a user:TSS REM(acid|CERTAUTH|CERTSITE) {DIGICERT(8-byte name)}{LABLCERT(label name)}{SERIALNUM(serial number) ISSUERDN(issuer's dist' name)}An example for the REMOVE command follows:TSS REMOVE(USER01) DIGICERT(DIGI0001)Determining if a Certificate has been Added to eTrust CA-Top SecretYou can check to see who has a certificate in a specified data set. The CHKCERTcommand determines whether the digital certificate in the specified data set hasbeen added to the eTrust CA-Top Secret security file and associated with an acid.Use the following syntax for TSS CHKCERT:TSS CHKCERT DCDSN(input data-set-name) PKCSPASS(pksc12-password)DCDSN(input-data-set-name)—Specifies the name of an optional data set thatcontains the PKCS#10 certificate request data. The request data set name can bethe output from a TSS GENREQ command. The request data contains the user'sgenerated public key and X.509 distinguished name. The request data must besigned, DER-encoded, and then Base64 encoded according to PKCS#10 standard.PKCSPASS—The PKCS-password can be up to 255 characters, is case sensitive,and can contain blanks.1–64 Cookbook

Digital Certificate SupportImportant! The password associated with PKCS#12 certificates are notviewable. It is the eTrust CA-Top Secret administrator's responsibility to keep track ofthe PKCS#12 password that is assigned to the digital certificate.Exporting Certificates to Data SetsYou can export a certificate from a eTrust CA-Top Secret security file to a newdata set using the TSS EXPORT command. The certificate to be exported can beidentified by its DIGICERT name or by its label. You cannot export a digitalcertificate with ICSF.Use the following syntax for TSS EXPORT:TSS EXPORT(acid|CERTAUTH|CERTSITE){DIGICERT(name) {LABLCERT{up to 32 characters)}{DCDSN(output-data set name) FORMAT(format type)}{PKCSPASS(PKCS#12 password)}ACID—A user acid or you can specify:CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (CA). This acid ispre-defined in Top Secret or you can specify. You cannot add a KEYRING to thisACID.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in Top Secret. You cannot add a KEYRING tothis ACID.DIGICERT—Specifies a one- to eight-character ID that identifies the certificatewith the user acid. The DIGICERT must be entered as part of all GENCERTcommands since this keyword indicates the name to be used in the digitalcertificate.DCDSN(output-data-set-name)—The data set will be allocated and cataloged,and will contain the output from the exported digital certificate. The data setname will conform to the MVS standards, up to a maximum of 26 characters.FORMAT—The following operands can be used with the FORMAT keyword:■■■■CERTB64—Indicates Base64 encoded certificates (default).CERTDER—Indicates DER encoded X.509 certificates.PKCS12B64—Indicates DER encoded (then Base64 encoded) PKCS#12package.PKCS12DER—Indicates DER encoded PKCS#12 package.An example for the FORMAT command follows:TSS EXPORT(USER01) DIGICERT(DIGI0001) DCDSN(USER3.CERT.DATA) FORMAT(CERTDER)Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–65

Digital Certificate SupportImportant! The password associated with PKCS#12 certificates are notviewable. It is the <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> administrator's responsibility to keep track ofthe PKCS#12 password that is assigned to the digital certificate.Exporting Certificates to Data SetsYou can export a certificate from a <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> security file to a newdata set using the TSS EXPORT comm<strong>and</strong>. The certificate to be exported can beidentified by its DIGICERT name or by its label. You cannot export a digitalcertificate with ICSF.Use the following syntax <strong>for</strong> TSS EXPORT:TSS EXPORT(acid|CERTAUTH|CERTSITE){DIGICERT(name) {LABLCERT{up to 32 characters)}{DCDSN(output-data set name) FORMAT(<strong>for</strong>mat type)}{PKCSPASS(PKCS#12 password)}ACID—A user acid or you can specify:CERTAUTH—Is an acid in which your installation can maintain certificates thatwere generated by a third party certificate authority (<strong>CA</strong>). This acid ispre-defined in <strong>Top</strong> <strong>Secret</strong> or you can specify. You cannot add a KEYRING to thisACID.CERTSITE—Is an acid in which your installation can maintain site-generatedcertificates. This acid is pre-defined in <strong>Top</strong> <strong>Secret</strong>. You cannot add a KEYRING tothis ACID.DIGICERT—Specifies a one- to eight-character ID that identifies the certificatewith the user acid. The DIGICERT must be entered as part of all GENCERTcomm<strong>and</strong>s since this keyword indicates the name to be used in the digitalcertificate.DCDSN(output-data-set-name)—The data set will be allocated <strong>and</strong> cataloged,<strong>and</strong> will contain the output from the exported digital certificate. The data setname will con<strong>for</strong>m to the MVS st<strong>and</strong>ards, up to a maximum of 26 characters.FORMAT—The following oper<strong>and</strong>s can be used with the FORMAT keyword:■■■■CERTB64—Indicates Base64 encoded certificates (default).CERTDER—Indicates DER encoded X.509 certificates.PKCS12B64—Indicates DER encoded (then Base64 encoded) PKCS#12package.PKCS12DER—Indicates DER encoded PKCS#12 package.An example <strong>for</strong> the FORMAT comm<strong>and</strong> follows:TSS EXPORT(USER01) DIGICERT(DIGI0001) DCDSN(USER3.CERT.DATA) FORMAT(CERTDER)Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–65

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!