Keywords › UNBIND Keyword—Remove Certificate from PKCS#11 Token

UNBIND Keyword—Remove Certificate from PKCS#11 Token

Valid on z/OS.

Use the UNBIND keyword with the P11TOKEN function to remove a certificate from a PKCS#11 token.

The certificate to be removed is identified by one of:

• The certificate label name and userid (certificate must be defined to CA Top Secret)
• The sequence number in the token (certificate does not have to be defined to CA Top Secret)

The keyword has the following format:

TSS P11TOKEN UNBIND 
             LABLCTKN(token name) 
             SEQNUM(nnnnnnnn)|LABLCERT(certificate label) 
             TOKNUSER(userid)   
             FORCE  

LABLCTKN(token name)

Specifies the name of the token being deleted. The token must already exist.

SEQNUM(nnnnnnnn)

Specifies the sequence number of the certificate to remove from the token. If the certificate is not defined to CA Top Secret, then FORCE must be specified. LABLCERT and SEQNUM are mutually exclusive.

LABLCERT(certificate label)

Specifies the digital certificate label name of the certificate to unbind. TOKNUSER must also be specified. LABLCERT and SEQNUM are mutually exclusive.

TOKNUSER(userid)

Specifies the userid for the digital certificate.

FORCE

Specifies that the certificate is to be removed even if it is not defined to CA Top Secret. May only be used when SEQNUM is specified.

This keyword is used with MISC3(PTOK) authority.

Controlled by ICSF using resources in the CRYPTOZ class. Authority to resources in the IBMFAC class is not required.