I tried to use PKI Services to generate a certificate so I could do OCSP verification. I tried using the R_PKIServ Security Service Callable API. This ultimately failed because key generation with PKI Server is not supported on my zPDT system running z/OS on my Linux system. Below are some of the things I learned about using this interface.
Most of the documentation is there and complete, it assumes you are an expert in this area, so it is a bit tough when you are new to it.
I found there are two modes of operation, (this was not clear)
- one is the SAF interface, and is an API for issuing the RACDCERT requests – read up on the RACDCERT GENCERT(request-dataset-name) command,
- The other is to use the PKI server, and to store stuff in ICSF,and not use RACF.
My zPDT system does not support PKI to generate certificates, so I cannot comment on that.
The SAF/PKI mode of operation is determined by the SIGNWITH option.
- SIGNWITH PKI: says use PKI,
- SIGNWITH SAF:CERTAUTH/COLIN-CA says use SAF, and the specified CA certificate.
Options for Gencert
Table 2. CertPlist for GENCERT and REQCERT defines all the options for GENCERT. Many of them apply only to PKI. (The fields have “Only valid with PKI Services requests” in the field description.) Some parameters are used to defined the parameters of a certificate, other provide information about the certificate.
For SAF, these fields provide “other information”
- DiagInfo – this is very helpful for diagnosing problems, it gives the name of the field causing problems, see below.
- SignWith – this defines whether SAF or PKI is used. If SAF, this is the CA certificate.
- Userid – which ID will own the certificate
- Label – this is the name the certificate to be stored in the RACF database.
These fields provide information for the certificate
- CommonName
- PublicCert – this is a Base 64 encoded certificate request you want to sign and store in RACF
- Title
- OrgUnit (OU)
- Org
- Locality
- StateProv
- Country
- KeyUsage – some values are valid with SAF
- NotBefore
- NotAfter
- AltIPAddr
- AltURI
It does not matter the order you specify these components. The CN that was generated came out as
CN=Colin.T=COLINTITLE.OU=OUSSS.O=SSS.C=GB
exactly the same as if you issued the RACDCERT GENCERT command.
Diagnostic information
You have to provide a field called DiagInfo. This has some very good diagnostic information, especially when you get a return code saying “one of your parameters is not supported”. For example I got
safrc 8 racfrc 8 racfrs 52, where 52 means Incorrect field value specified in CertPlist.
The DiagInfo field layout is
- “DiagInfo ” eye catcher
- an integer length of the following field
- the additional information, in my case it was “SignWith”. I had specified SignWith:PKI which was not supported.
Once the field had
“Label” specified is already in use (IRRD111I)
so you can sometimes get the RACF (RACDCERT) error message as well.
SAF interface and Public Cert
You can use this interface with a certificate request.
My certificate request was in a file with a format like
—–BEGIN CERTIFICATE REQUEST—–
MII…
…
C/l/hL4HV/iU2iX8EFr3BPlA2A==
—–END CERTIFICATE REQUEST—–
I read in the data between the Begin certificate request and the End certificate request, and passed this in as the PublicCert.
ColinPaice 