Using Digital Certificates › Digital Certificates and Key Rings › How Digital Certificates Are Used

How Digital Certificates Are Used

Digital certificates are stored in key rings so that they can be referred to by an authorized user or application when needed. The following points outline the process of how CA Tape Encryption uses digital certificates:

• To use a specific digital certificate, the certificate must reside on a key ring that is associated with the CA Tape Encryption task or the end user who wants to use the certificate.
• To identify which certificate to use in a given situation, the user must specify which key ring the certificate is on, as well as which certificate on the key ring to use.
  • The user references the key ring using a name selected when the key ring was created.
  • The user explicitly specifies the key ring in the DFSMS data class description parameter, as shown in the following example if you are using DFSMS:

    BES=(RSA(SYSTEMRING):CERTIFICATEZ,AES128)
    

    In these examples, the certificate CERTIFICATEZ is specifically searched for on key ring SYSTEMRING.

    If you are using the security system to select data sets for encryption, set a similar parameter in the userdata field of the appropriate data set security profile:

    BES=(RSA(SYSTEMRING):CERTIFICATEZ.AES128)
    

    Note: When specifying this parameter for the userdata field in your security system, a period separates the certificate name and algorithm

• For each user, each key ring name must be unlike all other key rings owned by that user.
• Digital certificates are also given a name when they are created by the owner. This name is the digital certificate label, which identifies individual certificates on a ring.
• The specific digital certificate is identified by user, key ring name, and digital certificate label.