Certificate Utility

This section contains the following topics:

About the Certificate Utility

Authorization

Sample Certificate Utility JCL

Sample Output - Summary

Sample Report Output - Detail

Sample Report Output - Detail Ext

Sample Output - Totals

Sample Output “Signed by:” Field Definition

Certificate Utility Parameters

About the Certificate Utility

Use the Certificate Utility to display the certificate hierarchy in your database. Optionally, it will display each certificate, its signing certificate, the certificates that it has signed, and all of the information provided with the CHKCERT and LIST commands. Execution of SAFCRRPT requires a region size of 1500K.

You can tailor the output to display certificates:

For a specified user
For a specified key ring
That have not expired
That have a key in ICSF
That are currently trusted
That will expire within a specified number of days

If you are having a problem setting up SSL for an application, run the utility against the key ring to identify problems in the set up.

Authorization

If the certificates are not obtained from a key ring, update access to IRR.DIGTCERT.LIST in the IBMFAC class is required to run the report.

If the certificates are from a key ring, the utility uses the R_datalib callable service. R_datalib requires READ access to the IRR.DIGTCERT.LISTRING resource in the IBMFAC class when the key ring is owned by the caller of the utility.

If the key ring is not owned by the caller of the utility, or the key ring is owned by CERTAUTH or SITE, UPDATE access is required to the IRR.DIGTCERT.LISTRING resource.