Keywords › SIGNWITH—Certificate Private Key

SIGNWITH—Certificate Private Key

Valid on z/OS.

Use the SIGNWITH keyword to specify the digital certificate with a private key signing the certificate. If not specified, the default is to sign the certificate with the private key of the certificate being generated, creating a self‑signed certificate.

If SIGNWITH is specified, it must refer to a certificate that has a private key associated with it. If no private key is associated with the certificate, an informational message is generated and processing stops.

If DCDSN is specified on the GENCERT command, the SIGNWITH keyword is required.

Self‑signed certificates are always trusted, while all other certificates are created with the trust status of the certificate specified with the SIGNWITH keyword. If the certificate specified in the SIGNWITH keyword is not trusted, an informational message is issued, but the certificate is still generated.

This keyword has the following format:

TSS GENCERT SIGNWITH(acid,digicert)

The keyword is used with:

• The GENCERT command
• The ACID types User, DCA, VCA, ZCA, LSCA, and SCA
• ACID(MAINTAIN) and MISC4(CERTGEN) authority, MISC4(CERTSITE) for CERTSITE ACID, and MISC4(CERTAUTH) for CERTAUTH ACID

Example: SIGNWITH keyword

This example indicates a digital certificate signed with a private key:

TSS GENCERT(user1) DIGICERT(cert0001)
                   DCDSN(user1.cert.data)
                   SIGNWITH(user1,cert0001)