FORCE Keyword—Bypass Checks

Valid on z/OS.

Use the FORCE keyword to perform either of the following activities:

Perform a rollover unconditionally (replacing an old certificate with a new certificate).
Remove a certificate that has been the target of a GENREQ command from a user.

When you specify the FORCE keyword, the following checks are not performed:

The values of DIGICERT and NEWDIGIC must be different.
The certificates identified by DIGICERT and NEWDIGIC must both have private keys associated with them.
The certificate identified by NEWDIGIC must have never been the target of a previously issued ROLLOVER command and never used to sign other certificates.
The original certificate must not have had a GENREQ issued against it.

Important! If DIGICERT and NEWDIGIC have the same value, and you have also specified the FORCE keyword, the product deletes the private key of the certificate.

This keyword has the following format:

TSS ROLLOVER(acid) DIGICERT(old_certificate_id)
                   NEWDIGIC(new_certificate_id)
                   FORCE

acid: Specifies the user ACID associated with the certificate.

This keyword is used with:

The REMOVE and ROLLOVER commands
The ACID types User, DCA, VCA, ZCA, LSCA, and SCA
ACID(MAINTAIN) and MISC4(CERTGEN) authority for users
MISC4(CERTSITE) authority for CERTSITE ACIDs
MISC4(CERTAUTH) authority for CERTAUTH ACIDs

Example: Replace the TEN Certificate with the NINE Certificate

This example completes the re-keying of the TEN certificate by replacing the TEN certificate with the NINE certificate:

TSS ROLLOVER(CERTSITE) DIGICERT(NINE)
                       NEWDIGIC(TEN)
                       FORCE