Keywords › PCICC Keyword—Generate Keys with PCI Cryptographic Coprocessor

PCICC Keyword—Generate Keys with PCI Cryptographic Coprocessor

Valid on z/OS.

Use the PCICC keyword to specify that the key pair is generated using the PCI Cryptographic Coprocessor, and that the private key is stored in ICSF PKDS. When PCICC is not specified, the key pair is generated using software. PCICC cannot be used with the DSN, DSA, or ICSF parameters. If a PCI cryptographic coprocessor is not present or operational, or if ICSF is not active or configured for PKA operations, an error message is displayed and processing terminates.

If ICSF, PCICC, or LABLPKDS is not specified, software generates the key pair and the private key is stored in the security file as a non-ICSF key.

This keyword has the following format:

TSS REKEY(acid) DIGICERT(8‑byte name)
                DCDSN(dsname)
                PCICC

This keyword is used with:

• The commands ADDTO, GENCERT, REKEY and RENEW
• The ACID types User, DCA, VCA, ZCA, LSCA, and SCA
• ACID(MAINTAIN) authority for users
• MISC4(CERTUSER) authority for user ACIDs
• MISC4(CERTSITE) authority for CERTSITE ACIDs
• MISC4(CERTAUTH) authority for CERTAUTH ACIDs

Examples: PCICC keyword

This example indicates that the digital certificate is stored in an PCICC facility:

TSS ADDTO(USERA) DIGICERT(USERACER)
                 DCDSN(USERA.CERT01)
                 PCICC

This example removes the entry in the PCICC storage facility by removing the DIGICERT from the acid:

TSS REMOVE(USERA) DIGICERT(USERACER)