Creating private keys, certificates, and a Trusted Certification Authority Chain
About this task
Use the GskKyman command line utility of z/OS® Cryptographic Services System
SSL to accomplish the following tasks:
- Create the keystore database on the IBM Z Workload Scheduler master.
This database contains the private key and trusted certificates. Because
this keystore database contains a private key, it should be protected.
It can be saved under any directory that allows read access to the tws user
such as WRKDIR
/ssl/TWS.kdb, where WRKDIR is the directory specified in the WRKDIR keyword in the TOPOLOGY statement - Store the Keystore database password in a file. This password
will be encrypted and saved in a file that should be stored in any
directory that allows read access to the tws user, such as WRKDIR
/ssl/TWS.sth
After these steps, the administrator can start to:
- Create public-private key pairs
- Create certificate requests
- Store signed certificates in the database (the WRKDIR/Security directory)
- Create self-signed certificates
- Add or remove Certification Authority from the trust list
For details, see z/OS® Cryptographic Services Secure Socket Layer Programming, SC24-5901.