CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

192 CICS Transaction Gateway V5
For more details on System SSL and the gskkyman utility, refer to OS/390
V2R10.0 System SSL Programming Guide and Reference, SC24-5877.
Requesting an externally signed test certificate
Once we had created our key database, we performed the following steps to
request an externally signed test certificate.
1. In order to obtain an externally signed certificate from a certificate authority
(CA), we first had to generate a certificate signing request (CSR). We chose
Option 3 (Create New Key Pair and Certificate Request) from the Key
database menu and entered the definitions in Table 8-4 on page 188, as
shown in Example 8-3.
Example 8-3 Creating a new key pair and certificate request
Enter option number (or press ENTER to return to the parent menu): 3
Enter certificate request file name or press ENTER for "certreq.arm":
Enter a label for this key................> ITSO
Select desired key size from the following options (512):
1: 512
2: 1024
Enter the number corresponding to the key size you want: 2
Enter certificate subject name fields in the following.
Common Name (required)................> wtsc66oe.itso.ibm.com
Organization (required)...............> IBM
Organization Unit (optional)..........> ITSO
City/Locality (optional)..............> San Jose
State/Province (optional).............> California
Country Name (required 2 characters)..> US
Please wait while key pair is created...
Your request has completed successfully, exit gskkyman? (1 = yes, 0 = no) [0]:
Important: When creating the certificate request in gskkyman, we found that
we needed to specify all fields including the optional ones. We could not use
an abbreviation for the state/province; otherwise VeriSign rejected our
certificate signing request.
2. After the certificate had been generated, we checked the contents of the file
(Example 8-4) using the following UNIX System Services command:
cat certreq.arm
Example 8-4 Contents of the certificate request file
$ [SC66] /ctg/scsctg5: cat certreq.arm
-----BEGIN NEW CERTIFICATE REQUEST-----