CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

194 CICS Transaction Gateway V5
Note: We found that VeriSign would only issue one certificate for a server, so
we were unable to obtain a test certificate to use with our SSL protocol
handler.
Receiving our test certificate
Once we received our test certificate, we copied and pasted this into a file
(verisigncert.arm) on our workstation using the Notepad Editor (being very
careful to remove any trailing space characters), and then transferred this to the
HFS directory /web/scsctg5 on z/OS using FTP in ASCII mode. We then received
this into our key database on z/OS using Option 4 of the Key Database Menu -
Receive a certificate issued for your request.
Example 8-5 Receiving the certificate issued for our request
Enter certificate file name or press ENTER for “cert.arm” verisigncert.arm
Do you want to set the key as the default in your key database?
(1 = yes, 0 = no) [1]
Please wait while certificate is received......
Your request has completed successfully, exit gskkyman?
(1 = yes, 0 = no) [0]: 0
JSSE
For JSSE it was necessary to create a server keystore and create a self-signed
certificate. We used the keytool to complete these steps.
Creating a keystore on z/OS using keytool
We performed the following steps to create our keystore on z/OS using keytool:
1. In a z/OS UNIX System Services shell we changed the directory to the HFS
directory /ctg/scsctg5 we were using for our z/OS CICS TG.
2. We used the keytool command in Example 8-6 to invoke the Key
Management Tool to create a keystore with a self-signed certificate in the file
jssesslss.jks.
Example 8-6 Using keytool to create a keystore with a self-signed certificate
keytool -genkey -alias ITSO -keysize 1024
-dname "cn=wtsc66oe.itso.ibm.com,o=IBM,ou=ITSO,l=San Jose,s=California,c=US"
-keystore jssesslss.jks -keypass default -storepass default -keyalg RSA
The options on the keytool command are as follows: