Keywords › BIND Keyword—Bind a Certificate to a PKCS#11 Token

BIND Keyword—Bind a Certificate to a PKCS#11 Token

Valid on z/OS.

Use the BIND keyword with the P11TOKEN function to bind a digital certificate to a z/OS PKCS#11 token. When a certificate is bound to a token, CA Top Secret creates a certificate, public key and private key (if the certificate has one and the BIND usage is personal).

The following key types are not supported:

• DSA public keys
• DSA, ICSF and PCICC private keys

The command has the following format:

TSS P11TOKEN BIND 
             LABLCTKN(token name) 
             TOKNDATA(userid,digicert)|LABLCERT(certificate label)|
             TOKNUSER(userid)
             [USAGE(PERSONAL|CERTSITE|CERTAUTH]
             [DEFAULT] 

LABLCTKN(token name)

Specifies the name of the token. The token must already exist.

TOKNDATA(userid,digicert)

Userid specifies the ACID for the digital certificate. Digicert identifies the digital certificate. LABLCERT and TOKNDATA are mutually exclusive.

LABLCERT(certificate label)

Specifies the digital certificate label name of the certificate to bind. The userid for the certificate may be specified with the TOKENUSER keyword. If TOKNUSER is not specified then the userid of the administrator that issued the command is used. LABLCERT and TOKNDATA are mutually exclusive.

TOKNUSER(userid)

Specifies the userid for the digital certificate

USAGE[PERSONAL|CERTSITE|CERTAUTH]

Specifies how this certificate is used within the token. If usage is not specified, it defaults to the usage value of the certificate being bound.

DEFAULT

Specifies that the certificate is the default certificate for the token. Only one certificate may be the default. If a default certificate already exists, its default status is removed.

BIND Authority Levels

The administrator must have:

• MISC3(PTOK) authority
• MISC4(CERTSITE) authority when the certificate is from the CERTSITE acid
• MISC4(CERTAUTH) authority when the certificate is from the CERTAUTH acid

Controlled by ICSF using resources in the CRYPTOZ and IBMFAC resource classes.

To bind a certificate to a PKCS#11 token for USAGE personal use, the authority required is:

• For one's own certificate—Sufficient authority to CRYPTOZ resources and READ authority to IRR.DIGTCERT.BIND
• For someone else's certificate—Sufficient authority to CRYPTOZ resources and UPDATE authority to IRR.DIGTCERT.BIND
• For CERTSITE or CERTAUTH certificate—Sufficient authority to CRYPTOZ resources and CONTROL authority to IRR.DIGTCERT.BIND

To bind a certificate to a PKCS#11 token for USAGE CERTSITE or CERTAUTH use the authority required:

• For one's own certificate is sufficient authority to CRYPTOZ resources, CONTROL authority to IRR.DIGTCERT.ADD and READ authority to IRR.DIGTCERT.BIND
• For someone else's certificate is sufficient authority to CRYPTOZ resources, CONTROL authority to IRR.DIGTCERT.ADD and UPDATE authority to IRR.DIGTCERT.BIND
• For CERTSITE or CERTAUTH certificate is sufficient authority to CRYPTOZ resources and UPDATE authority

Example: BIND keyword

This example binds the certificate CERT001 to the token TOKEN#1:

TSS P11TOKEN BIND LABLCTKN(token#1) TOKENDATA(user01,cert0001)