Defining SSL security for servers

Before you begin

You need to request a certificate authority (CA) certificate and a signed certificate for your server. If you plan to implement SSL client certificate support, you must also have CA certificates from each certificate authority that verifies your client certificates. Additionally, you must have a user ID with the authority to use the RACDCERT command in the Resource Access Control Facility (RACF) (for example, SPECIAL authority).

Why and when to perform this task

Complete the following steps for RACF to authorize the server to use digital certificates. SSL uses digital certificates and public and private keys. If your application server uses Secure Sockets Layer (SSL), you must use RACF to store digital certificates, and you must use \public and private keys for the user identities under which the server controllers run.

Steps for this task

  1. For each server that uses SSL, create a key ring for that server's controller user ID.
    Example: Your controller is associated with the user ID called ASCR1. Issue the following command:
    RACDCERT ADDRING(ACRRING) ID(ASCR1)
  2. Receive the certificate for your application server from the certificate authority.
    Example: You requested a certificate and the certificate authority returned the signed certificate to you, which you stored in a file called ASCR1.CA. Issue the following command:
    RACDCERT ID (ASCR1) ADD('ASCR1.CA') WITHLABEL('ACRCERT') PASSWORD('password')
  3. Connect the signed certificate to the controller user ID's key ring and make the certificate the default certificate.
    Example: Connect the certificate labeled ACRCERT to the key ring ACRRING owned by ASCR1. Issue the following command:
    RACDCERT ID(ASCR1) CONNECT (ID(ASCR1) LABEL('ACRCERT') RING(ACRRING) DEFAULT)
  4. If you plan to have the server authenticate clients (SSL client certificate support), complete the following steps:
    1. Receive each certificate authority (CA) certificate that verifies your client certificates.
      Example: Receive the CA certificate that will verify a client with user ID CLIENT1. That certificate is in a file called USER.CLIENT1.CA. Issue the following command:
      RACDCERT ADD('USER.CLIENT1.CA') WITHLABEL('CLIENT1 CA') CERTAUTH
    2. Give each CA certificate the CERTAUTH attribute.

      Connect each client's certificate authority (CA) certificate to the controller user ID's key ring.

      Example: Connect the CLIENT1 CA certificate to the ring ACRRING owned by ASCR1.

      RACDCERT ID(ASCR1) CONNECT(CERTAUTH LABEL('CLIENT1 CA') RING(ACRRING))

  5. Give read access for IRR.DIGTCERT.LIST and IRR.DIGTCERT.LISTRING in the RACF FACILITY class to the controller user ID.
    Example: Your controller user ID is ASCR1. Issue:
    
    PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(ASCR1) ACC(READ) 
    PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(ASCR1) ACC(READ)
    

What to do next

You are done with the RACF phase when the RACF commands succeed.


Related concepts
SSL repertoires
Related tasks
Setting up Secure Sockets Layer security for WebSphere Application Server for z/OS



Searchable topic ID:   tsecdefinsslsec
Last updated: Jun 21, 2007 9:56:50 PM CDT    WebSphere Application Server for z/OS, Version 5.0.2
http://publib.boulder.ibm.com/infocenter/wasinfo/index.jsp?topic=/com.ibm.websphere.zseries.doc/info/zseries/ae/tsec_definsslsec.html

Library | Support | Terms of Use | Feedback