MQSeries.net :: View topic

cicsprog · Posted: Tue Nov 04, 2008 10:50 pm Post subject:

We our a large shop (130 z/OS MQM's). Just starting to do SSL on some channels - point-to-point and Clients.

I want to limit the amount of Administration we need to do for this. Is using RACF or a Vendor CA a better way to go? Obviously a Vendor CA costs money.

Each one of our Jes plexes has a Verisign CA. It gets used by FTP and other z/OS software. Is there a way to use that so we wouldn't have to create/buy are own CA's? I tried to create a personal CERT for a Windows Client using the Verisign:

RACDCERT ID(MQD0CHIN) GENCERT +
SUBJECTSDN (CN('AUTHENTICATOR') +
T('CLIENT CERTIFICATE WINDOWES') +
OU('BE MQ') +
O('BE MQ') +
L('RTP') +
SP('FL') +
C('USA')) +
NOTAFTER(DATE(2015/12/31)) +
NOTBEFORE(DATE(2008/01/01)) +
SIZE(1024) +
WITHLABEL('ibmwebspheremqv107964') +
SIGNWITH(CERTAUTH LABEL('Verisign Class 3 Primary CA'))

But, I get a RACF RC of - no Private key stored with this signer certificate.

Since our RACF ADmins have no clue about this stuff, I'm trying to figure all this out myself. And, of course, I have no access to RACF (even on our sandbox).

Thanks for any input.