Command Functions › EXPORT Function—Write a Certificate to a Data Set

EXPORT Function—Write a Certificate to a Data Set

Use the EXPORT command function to export digital certificates to a new data set (DCDSN) after it has been added to a user. From there it can be exported to a browser or transferred to another platform.

The DIGICERT name or the LABLCERT label name must be entered as part of all EXPORT functions since these keywords indicate the certificate being exported.

EXPORT by default, gives you the certificate and the public key. When you do an EXPORT with either one of the PKCS#12 package formats (PKCS12DER or PKCS12B64) you get the certificate, public key and any inherited signing certificates.

The EXPORT DCDSN (data set) must not be defined or the output DCDSN cannot be allocated or cataloged.

Administrators must have:

• ACID(MAINTAIN) for users within their scope
• MISC4(CERTEXPO) and MISC4(CERTSITE) for CERTSITE ACID
• MISC4(CERTAUTH) for CERTAUTH ACID
• Administrators without the above authorities can issue the EXPORT command if they have:
  • UPDATE access to TSSCMD.CERTUSER.EXPORT in the CASECAUT resource class when the certificate is associated with a user ACID
  • UPDATE access to TSSCMD.CERTSITE.EXPORT in the CASECAUT resource class when referencing a site certificate
  • UPDATE access to TSSCMD.CERTAUTH.EXPORT in the CASECAUT resource class when referencing a certificate-authority certificate

This command function has the following format:

TSS EXPORT(acid) [DIGICERT(name)|LABLCERT(label‑name)]
                 DCDSN(output‑data‑set‑name)
                 FORMAT(format type)
                 PKCSPASS(PKCS#12 password)

acid

Specifies the ACID for the digital certificate being exported.

DIGICERT(name)

Specifies the keyword that identifies the digital certificate being exported.

LABLCERT(label‑name)

Specifies the keyword that identifies digital certificate label name being exported.

DCDSN(output‑data‑set‑name)

Specifies the data set name the digital certificate is written to.

FORMAT(format type)

Specifies the format; CERTB64, CERTDER, PKCS12B64, PKCS12DER, PKCS7B64, or PKCS7DER.

PKCSPASS(PKCS#12 password)

Defines the PKCS#12 formats password when FORMAT(PKCS12nnn) is used.