Digital certificate
A file that proves the identity of a server or user for encrypted connections; on z/OS, RACF stores them and groups them in key rings.
Also written certificate, RACDCERT, key ring, keyring, X.509 certificate, TLS certificate
A digital certificate is an electronic proof of identity, used mainly to set up encrypted connections with TLS. When you connect to a website securely, its certificate proves it is the real site. Mainframe services work the same way: TN3270 sessions, z/OSMF, MQ channels, file transfers and web services all use certificates.
On z/OS, certificates are usually stored in RACF and managed with the RACDCERT command. A key ring is a named collection of certificates that one application or server uses, such as the server's own certificate plus the certificates of the authorities it trusts. Each server is set up to use a particular key ring.
Certificates have an expiry date. When a server's certificate expires, clients refuse to connect, and a service can stop working without any change to the system. This is one of the most common causes of unexpected outages, so sites keep a list of certificates and renew them well in advance.
Private keys, the secret half of a certificate, may be stored in RACF or protected by ICSF and the cryptographic hardware.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- ICSFIntegrated Cryptographic Service Facility: the part of z/OS that gives programs access to the mainframe's encryption hardware and keys.
- File transferMoving data between the mainframe and other systems, where character encoding and record structure both need attention.
- IBM MQMessaging software that passes messages between programs, on the same system or across many systems, so they can work together without waiting for each other.
- z/OSMFz/OS Management Facility: a web interface and set of web APIs for working with z/OS from a browser or another program.