Creating SSL Certificates Using a Certificate Authority

You can use a certificate authority to create SSL certificates.

In the following steps, a user ID of mftps is used. If the user ID associated with the platform server started task is different from this, you must make the changes to the sample commands.

For more information on the exact format of the RACF commands and keywords, see z/OS Security Server (RACF) Command Language Reference.

Procedure

Create a key ring.
A key ring is the equivalent of a key database. The key ring name must be specified on the GLOBAL SSL_KEY_DBNAME parameter. Therefore, you cannot embed any spaces in the key ring name.
See the following example of RACF command used to create a key ring:
RACDCERT ID(mftps) ADDRING(FusionRing)

This command adds a key ring called FusionRing. This name is case sensitive. When you supply this name to the platform server SSL_KEY_DBNAME parameter, you must use exactly the same name as is used on the ADDRING parameter.

Add the certificate authority certificate.

This certificate usually can be found on a web site, or your security administrator can send it to you. This certificate contains the CA public key and is used to verify the certificates that are signed with the private key of CA. This certificate is typically the same for all users that use CA.

See the following example of a certificate authority certificate.

Note: You must save the certificate in a data set with a RECFM of V or VB. If you specify any other RECFM, the certificate is invalid.

See the following example of RACF command used to add a certificate to the server. The command is listed on multiple lines for clarity purpose.

RACDCERT CERTAUTH
ADD(my.certca.dsn)
WITH(LABEL(‘CertAuth’))

At this point, the CA certificate has been added to the system.

Generate a self-signed certificate for the server.
Before you can generate a certificate request, you must create a self-signed certificate for the server. This certificate is internal to RACF and contains all the information required to create a certificate request.
See the following example of RACF command used to create a self-signed certificate for the server. The command is listed on multiple lines for clarity purpose.
```
RACDCERT ID(mftps)
GENCERT 
SUBJECTSDN(CN(‘domain.name’)
		OU(‘organization unit’)
		O(‘Organization’)
		SP(‘State/Province’)
		L(‘City or Locality’)
		C(‘xx’))				xx = 2 byte country name
WITHLABEL(‘fusionCert’)
```
This command has no output. Step 4 uses the certificate created in this step when generating a certificate request.

Generate a certificate request.

To create a certificate, you must present a certificate request to the certificate authority. This step produces a certificate request based on the self-signed certificate that you created in Step 3.

See the following example of RACF command used to create a certificate request for the server. The command is listed on multiple lines for clarity purpose.

RACDCERT ID(mftps)
GENREQ(LABEL(‘fusionCert’))
DSN(my.cert.req.dsn)

The output of this certificate request is a data set with a certificate with Base64 encoding. See the following example of a certificate request.

-----BEGIN NEW CERTIFICATE REQUEST-----                         
MIIB4TCCAUoCAQAwcTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCE5ldyBZb3JrMRQw
EgYDVQQHEwtHYXJkZW4gQ2l0eTERMA8GA1UEChMIUHJvZ2luZXQxFDASBgNVBAsT
C0RldmVsb3BtZW50MRAwDgYDVQQDEwdQU1NHUkVHMIGfMA0GCSqGSIb3DQEBAQUA
A4GNADCBiQKBgQDhiVQR+uODpNC9wPUk8bzBiGumyQfJPEUxVeU9p+nVZVvkFOuG
V9AOHRqXEkRk8TPG7/iVQfmlT4M6nuBD6kJbtxcVzG5YCuFyhF+xJ7wGkbgenXnW
7YCxQLLgH8l3Ao0R4f/4GjEJYqHfnL8X0+K0OcAyIzQ2k2o5VP7U9XaVwwIDAQAB
oDAwLgYJKoZIhvcNAQkOMSEwHzAdBgNVHQ4EFgQUFpgJNAq12G5fT+TJ3sLuY2hq
MYYwDQYJKoZIhvcNAQEFBQADgYEApQOfypfL9nASF8Qe3x9jaiAeAc7zKc/jyIq+
lvPABJf8pEFPHO2XjYwPKgEqw9cFlskOpGVm05FRUs+tWGlO9Fa6WLhv/uVnBseQ
I3Ytf7vbG/zqPV5aAQnSOq4HangZdiBIw3jtw0SNA4KeMtaVdv+sQ5YTYsBvUUxg
3W1Re3R=                                                        
-----END NEW CERTIFICATE REQUEST-----

At this point, you must send the certificate file to the certificate authority. The exact procedure depends on your organization and the certificate authority that you use. In some cases, you email the request, and in other cases, you cut and paste the certificate request into a web page.

Add the certificate request.

After the certificate authority processes the certificate, a certificate is created for you. You must save the certificate in a data set with a RECFM of V or VB. If you specify any other RECFM, the certificate is invalid.

See the following example of a certificate.

See the following example of RACF command used to add certificate for the server. The command is listed on multiple lines for clarity purpose.

RACDCERT ID(mftps)
ADD(my.cert.req.dsn)
WITH(LABEL(‘fusionCert’))

At this point, the certificate has been added to the system under user ID mftps.

Connect the certificate to the key ring.
To use the certificate, you must connect it to the key ring.
See the following example of RACF command used to connect the certificate to the key ring. The command is listed on multiple lines for clarity purpose.
```
RACDCERT ID(mftps)
CONNECT(ID(mftps) 
LABEL(‘fusionCert’)
RING(FusionRing)
DEFAULT)
```
Note: The DEFAULT parameter makes this certificate the default certificate for a key ring. You can override this parameter by using the GLOBAL SSL_DNLABEL and SSL_CLIENT_DNLABEL parameters.
Connect the CA certificate to the key ring.
The CA certificate is created in Step 2. You must connect it to the key ring if you want certificates to be authenticated with that CA.
See the following example of RACF command used to connect the CA certificate to the key ring. The command is listed on multiple lines for clarity purpose.
```
RACDCERT ID(mftps)
CONNECT(certauth 
LABEL(‘CertAuth’)
RING(FusionRing))
```

Result

At this point, you have a certificate that can be used to connect to other systems. You also have a certificate authority certificate that can be used to authenticate certificates received from other systems. The certificate processing has been completed, and you can start to use the platform server SSL on z/OS.

Contents

Index

Search Results

Creating SSL Certificates Using a Certificate Authority

Procedure

Result