Command Functions › CHKCERT Function—Check Certificates

CHKCERT Function—Check Certificates

Valid on z/OS.

Use the CHKCERT command function to display information about digital certificates. For example, you can display information about whether a digital certificate in a data set (DCDSN) is in the CA Top Secret security file and associated with an ACID.

The administrator must have MISC4(CERTCHEK) or UPDATE access to TSSCMD.CERTUSER.CHKCERT in the CASECAUT resource class.

This command function has the following format:

TSS CHKCERT DCDSN(input_dataset_name)
            PKCSPASS('pkcs#12_password')
            CHAIN

DCDSN(input_dataset_name)

Specifies the data set in which the digital certificate exists.

pkcs#12_password

(Required if the data set contains a PKCS#12‑formatted certificate that is password-protected) Specifies a case‑sensitive PKCS password that can also contain blanks. The passwords associated with PKCS #12 certificates are not viewable. It is the CA Top Secret administrator's responsibility to keep track of the PKCS #12 password assigned to the digital certificate.

Range: Up to 255 characters

CHAIN

(Optional) Displays information for each certificate in the chain of the input data set and displays the following summary information as applicable:

• Number of certificates in the chain
• Whether the chain is complete or incomplete
• Whether the chain contains expired or non-trusted certificates
• Whether any certificate in the data set is not present in the CA Top Secret database

Example: Display Certificate Associations

This example uses the DCDSN keyword to specify a certificate package:

TSS CHKCERT DCDSN(reipa02.user2.cert2)

The product reviews each certificate in the package. If a certificate is in the database, the product lists the user and ID to which the certificate is defined.