RACDCERT LISTTOKEN (List token)
Purpose
Use the RACDCERT LISTTOKEN command to display information about the certificate objects in a z/OS® PKCS #11 token.
Issuing options
The following table identifies
the eligible options for issuing the RACDCERT LISTTOKEN command:
As a RACF® TSO command? | As a RACF operator command? | With command direction? | With automatic command direction? | From the RACF parameter library? |
---|---|---|---|---|
Yes | No | No. (See rules.) | No. (See rules.) | No |
Rules: The
following rules apply when issuing this command.
- The RACDCERT command cannot be directed to a remote system using the AT or ONLYAT keyword.
- The updates made to the RACF database by RACDCERT are eligible for propagation with automatic direction of application updates based on the RRSFDATA profiles AUTODIRECT.target-node.DIGTCERT.APPL and AUTODIRECT.target-node.DIGTRING.APPL, where target-node is the remote node to which the update is to be propagated.
Authorization required
To
issue the RACDCERT LISTTOKEN command, you must have the following
authorizations:
- The SPECIAL attribute, or sufficient authority to the IRR.DIGTCERT.LIST resource in the FACILITY class based on the certificate owner.
- When your installation controls access to ICSF services and the CSFSERV class is active, READ access to the CSF1GAV and CSF1TRL resources in the CSFSERV class.
- Sufficient authority to the appropriate resources in the CRYPTOZ
class.
For details about CRYPTOZ and CSFSERV resources, see z/OS Cryptographic Services ICSF Administrator's Guide.
Your own certificate | Another user's certificate | SITE or CERTAUTH certificate |
---|---|---|
Sufficient authority to CRYPTOZ resources, and READ authority to IRR.DIGTCERT.LIST | Sufficient authority to CRYPTOZ resources, and UPDATE authority to IRR.DIGTCERT.LIST | Sufficient authority to CRYPTOZ resources, and CONTROL authority to IRR.DIGTCERT.LIST |
Related commands
- To list a certificate, see RACDCERT LIST.
- To list a key ring, see RACDCERT LISTRING.
Syntax
For the key to the symbols used in the command syntax diagrams, see Syntax of RACF commands and operands. The complete syntax of the RACDCERT LISTTOKEN is:
RACDCERT LISTTOKEN(token-name | * ) |
Note: The ID(certificate-owner) | SITE | CERTAUTH parameter
is ignored for this RACDCERT function.
If you specify more than one RACDCERT function, only the last specified function is processed. Extraneous keywords that are not related to the function being performed are ignored.
If you do not specify a RACDCERT function, LIST is the default function.
For information on issuing this command as a RACF TSO command, refer to RACF TSO commands.
Parameters
- LISTTOKEN(token-name | * )
- To
list all tokens that the command issuer is authorized to access, specify
LISTTOKEN (*). For each certificate object in the token that the command issuer is authorized to access with at least READ authority, the following information is displayed:
- The token name
- The sequence number of the certificate object in the token
- The DEFAULT status of the certificate within the token
- The status indicating whether the certificate has an associated private key
- The status indicating whether the certificate has an associated public key
- The certificate's usage within the token (PERSONAL, SITE or CERTAUTH)
- The ICSF token data set (TKDS) label assigned to the certificate object.
- If the certificate is installed in RACF, the RACF label of the certificate.
- If the certificate is installed in RACF,
the owner of the certificate is listed as one of the following values:
- ID(certificate-owner)
- CERTAUTH
- SITE
Examples
Example | Activity label | Description |
---|---|---|
1 | Operation | The security administrator wants to display information for all certificate objects in the z/OS PKCS #11 token called VENDOR.TOKEN. |
Known | ||
Commands | RACDCERT LISTTOKEN(VENDOR.TOKEN) | |
Output | See Figure 1. |
Figure 1. Output
of RACF details from the RACDCERT
LISTTOKEN command
RACDCERT LISTTOKEN(VENDOR.TOKEN)
Token: VENDOR.TOKEN
Seq Num Attributes Labels
-------- ------------------------------- --------------------------------------
1 Default: YES Priv Key: SECURE TKDS: HTTP Serv
Usage: PERSONAL Pub Key: YES RACF: Webserver Cert
Owner: ID(WEBSRV)
3 Default: NO Priv Key: NONE TKDS: Extranet CA
Usage: CERTAUTH Pub Key: NONE RACF: Extranet CA
Owner: CERTAUTH
4 Default: NO Priv Key: CLEAR TKDS: Code signing certificate
Usage: PERSONAL Pub Key: NONE