Command Functions › GENREQ Function—Generate a Certificate Request

GENREQ Function—Generate a Certificate Request

Valid on z/OS, z/VSE, and z/VM.

Use the GENREQ command function to generate a PKCS#10 base64‑encoded digital certificate request and write it to a data set. This request contains the subject's distinguished name and public key, and is signed with the private key associated with the specified certificate.

This command generates comments at the beginning of the certificate. Delete the comments if the application accepting the certificate does not support comments.

These requests can be sent to a third‑party certificate authority, such as Verisign, or they can be imported into and signed by CA Top Secret using the TSS GENCERT command function. The private key is then assigned by the third‑party authority, or when input into the TSS GENCERT command.

Specify the DCDSN keyword and the DIGICERT name or the LABLCERT label name since these keywords indicate the name used in the digital certificate. To use keyword GENREQ, the ACID and DIGICERT|LABLCERT must already exist. DIGICERT or LABLCERT is used to locate the certificate.

Administrators must have:

• ACID(MAINTAIN) and MISC4(CERTGEN for users within their scope
• MISC4(CERTSITE) for CERTSITE ACID
• MISC4(CERTAUTH) for CERTAUTH ACID

This command function has the following format:

TSS GENREQ(acid) DCDSN(output‑data‑set‑name)
                 DIGICERT(name) | LABLCERT(label‑name)

acid

The record key of the certificate to use to obtain the distinguished name and public key for the request, if LABLCERT is not also specified. This may be a one‑to‑eight character acid. If LABLCERT is specified, userid must be specified, and indicates the acid that the label is associated with.