Working with SSL/TLS on z/OS
This information describes how you set up and work with Transport Layer Security (TLS) on z/OS®.
Each topic includes examples of performing each task using RACF®. We can perform similar tasks using the other external security managers.
On z/OS, you must also set the number of server subtasks that each queue manager uses for processing TLS calls, as described in Set the SSLTASKS parameter on z/OS .
z/OS TLS support is integral to the operating system, and is known as System SSL . System SSL is part of the Cryptographic Services Base element of z/OS. The Cryptographic Services Base members are installed in the pdsname . SIEALNKE partitioned data set (PDS). When you install System SSL, ensure that you choose the appropriate options to provide the CipherSpecs that you require.
Additional user ID requirements for TLS on z/OS Set the SSLTASKS parameter on z/OS Set up a key repository on z/OS Locating the key repository for a queue manager on z/OS Specifying the key repository location for a queue manager on z/OS Giving the channel initiator the correct access rights on z/OS When changes to certificates or the key repository become effective on z/OS Creating a self-signed personal certificate on z/OS Requesting a personal certificate on z/OS Creating a RACF signed personal certificate Add personal certificates to a key repository on z/OS Exporting a personal certificate from a key repository on z/OS Delete a personal certificate from a key repository on z/OS Renaming a personal certificate in a key repository on z/OS Associating a user ID with a digital certificate on z/OS Defining a sender channel and transmission queue on QMA on z/OS DEFINE CHANNEL and DEFINE QLOCAL commands to set up the required objects.
Defining a receiver channel on QMB on z/OS DEFINE CHANNEL command to set up the required object.
Starting the sender channel on QMA on z/OS START CHANNEL command.
Exchanging self-signed certificates on z/OS Defining a sender channel and transmission queue on QM1 on z/OS DEFINE CHANNEL and DEFINE QLOCAL commands to set up the required objects.
Defining a receiver channel on QM2 on z/OS DEFINE CHANNEL command to set up the required object.
Starting the sender channel on QM1 on z/OS START CHANNEL command.
Refreshing the SSL or TLS environment on z/OS REFRESH SECURITY command.
Allowing anonymous connections on a receiver channel on z/OS ALTER CHANNEL command to make SSL or TLS client authentication optional.
Starting the sender channel on QM1 on z/OS START CHANNEL command.
Starting the sender channel on QMA on z/OS START CHANNEL command.
Parent topic: Working with SSL/TLS