eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Digital Certificate SupportReconnecting Private KeysWhen generating self-signed certificates using GENCERT, a public/private keypair is built and stored within the certificate. The private key always remainswith the certificate unless it is sent to a third-party as a certificate request. Whena GENREQ certificate request is sent to a third-party, the returned certificate willnot contain the private key. This happens because private keys are not shippedas part of a certificate request.To use a third-party certificate, the private key must be re-connected to thecertificate. This is accomplished automatically when a TSS ADD command isissued to re-connect the third-party certificate to the same user id that has the(model) certificate. The original, self-signed certificate private key, is connectedto the new certificate.As long as the user id is the same and the public key within the third-partycertificate matches the original certificate, the private key is connected.Listing Key Ring InformationYou can list all the acids and their keyrings associated with them by executingthe following command:TSS LIST(SDT) KEYRING(ALL)You can also list the associated KeyRing and LABLRING for a specific acid byexecuting the following command. The command must contain the name of theKeyRing or LABLRING already associated with the acid.TSS LIST(USER01) KEYRING(RING0001) orTSS LIST(USER01) LABLRING(LABELRING0002)Managing Certificate Serial NumbersAn application can invoke the R_Datalib callable service to manage serialnumbers for certificates.An application can increment the “last serial number issued” for a personal(user) certificate if the following conditions are met:■■The caller’s user ID is the user ID associated with the certificateThe caller’s user ID has at least READ authority to the IBMFAC resourceIRR.DIGTCERT.GENCERT.TSS PER(acid) IBMFAC(IRR.DIGTCERT.GENCERT) ACCESS(READ)Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–69