Configuring CICS® Distributed Program Link (DPL) agent to use HTTPS

As the currently logged in user, ensure that you have access to the following profiles:

• RACDCERT ADDRING: You must have the SPECIAL attribute or sufficient authority to modify the IRR.DIGTCERT.ADDRING resource in the FACILITY class. The following table shows the authority required for the RACDCERT ADDRING function:

  Table 1. Authority required for RACDCERT ADDRING function

  Access level	Purpose
  READ	Create a key ring for your own user ID.
  UPDATE	Create a key ring for another user.

• READ RACDCERT ADD:

  You must have the following authorizations:

  • The SPECIAL attribute or sufficient authority to the IRR.DIGTCERT.ADD resource in the FACILITY class for the intended purpose, as shown in Table 1.
  • READ access to the data set that contains the certificate being added.
  When you, as the current user, have access to ICSF services and the CSFSERV class is active, additional access to resources in the CSFSERV class might be required as follows:

  • When specifying PKDS, ICSF, or PCICC, you must have READ access to the CSFIQF, CSFPKI, CSFPKRC, and CSFPKRW resources.
  • If the certificate you are adding has an ECC key, you must also have the following access authorities:
    • When you specify PKDS, you must have READ access to the CSFDSV and CSFOWH resources.
    • When you omit PKDS, you must have READ access to the CSF1PKV, CSF1TRC, CSF1TRD, and CSFOWH resources.

  For details about the CSFSERV resources, see z/OS Cryptographic Services ICSF Administrator's Guide.
  The following table shows the authority required for the RACDCERT ADD function:

  Table 2. Authority required for the RACDCERT ADD function

  Access level	Purpose
  READ	Add a certificate to your own user ID.
  UPDATE	Add a certificate for another user ID.
  CONTROL	Add a SITE or CERTAUTH certificate.

• RACDCERT CONNECT:
  You must have the SPECIAL attribute or sufficient authority to the following resources in the FACILITY class, based on the certificate owner, key ring owner, and the USAGE value:

  • IRR.DIGTCERT.CONNECT
  • IRR.DIGTCERT.ADD

  With the USAGE keyword, you allow a certificate to be connected to a ring and used in a manner that differs from the certificate's original use. For example, by changing the USAGE value, a certificate defined as a user certificate might be used as a certificate-authority certificate. The USAGE keyword is powerful, and must be used in a controlled manner.
  The following table shows the access control checks that are performed when connecting to your own key ring:

  Table 3. Access control checks done when connecting to your own key ring

  USAGE value	Your own certificate	Anonther user's certificate	SITE or CERTAUTH certificate
  PERSONAL	READ authority to IRR.DIGTCERT.CONNECT	UPDATE authority to IRR.DIGTCERT.CONNECT	CONTROL authority to IRR.DIGTCERT.CONNECT
  SITE CERTAUTH	CONTROL authority to IRR.DIGTCERT.ADD and READ authority to IRR.DIGTCERT.CONNECT	CONTROL authority to IRR.DIGTCERT.ADD and UPDATE authority to IRR.DIGTCERT.CONNECT	UPDATE authority to IRR.DIGTCERT.CONNECT

  The following table shows the access control checks that are performed when connecting to another user's key ring:

  Table 4. Access control checks done when connecting to another user's key ring

  USAGE value	Your own certificate	Another user's certificate	SITE or CERTAUTH certificate
  PERSONAL	CONTROL authority to IRR.DIGTCERT.CONNECT	CONTROL authority to IRR.DIGTCERT.CONNECT	CONTROL authority to IRR.DIGTCERT.CONNECT
  SITE CERTAUTH	CONTROL authority to IRR.DIGTCERT.ADD and CONTROL authority to IRR.DIGTCERT.CONNECT	CONTROL authority to IRR.DIGTCERT.ADD and CONTROL authority to IRR.DIGTCERT.CONNECT	CONTROL authority to IRR.DIGTCERT.CONNECT