Configuring secure communications between z/OS components and Z APM Connect Distributed Gateway Linux machine

The Z APM Connect DG machine on Linux serve as the TLS server. To set up security for this Linux machine, use the ./zapmctl configure security command.

1. Switch to the installation directory <install-dir> and run ./zapmctl configure security. The <install-dir> path is the location where the fix pack tar file is extracted.
2. Respond with 1 to import matching keystores and truststores.

   It imports those certificate files into a directory <install-dir>/certs that is accessible to Z APM Connect.

   Z APM Connect supports only the Java™ KeyStores (JKS) keystore type to be used as keystores and truststores. A keystore contains personal certificates and a truststore contains CA certificates which the endpoint trusts.

   RSA certificates with keys of 2048 bits or more or Elliptic Curve (ECDSA) certificates with keys of 256 bits or more are recommended.

   1. Enter the filepath to Kafka truststore.
   2. Enter the filepath to Kafka keystore.
   3. Enter the filepath to Connection Manager truststore.
   4. Enter the filepath to Connection Manager keystore.
   When the Import complete. is prompted, you successfully imported all the necessary truststores and keystores.
3. Restart Z APM Connect DG by first running the sudo ./zapmctl stop command and then run the sudo ./zapmctl start command.
   After you import certificates on the Z APM Connect DG machine, create a key ring and a certificate on the z/OS components.

In the following command examples:

1. Create an internal certificate-authority (CA) certificate and refresh.

   RACDCERT CERTAUTH GENCERT                              -
      SUBJECTSDN(O('<organization name>')                 -
                 OU('<organizational unit name>')         -
                  C('<country>'))                         -
                  KEYUSAGE(CERTSIGN)                      -
                  WITHLABEL('<Internal CA Name>'))
   
   SETROPTS RACLIST(DIGTCERT) REFRESH

2. Create a personal certificate for the proc owner.

   RACDCERT ID(IBMUSER) GENCERT SUBJECTSDN(CN('<common name>')                                                   -
   								      O('<organization name>')                -
   									  OU('<organizational unit name>')    -
   									  C('<country>'))                     -
   					WITHLABEL('<IBMUSER Personal Certificate name>')                      -
   					SIGNWITH(CERTAUTH LABEL('<Internal CA Name>'))
   SETROPTS RACLIST(DIGTCERT) REFRESH

3. Create a key ring and add the new certificates.

   RACDCERT ID(IBMUSER) ADDRING(<keyring name>)
   RACDCERT ID(IBMUSER) CONNECT(CERTAUTH                                   -
                              LABEL('<Internal CA Name>')                  -
                              RING(<keyring name>)                         -
                              USAGE(CERTAUTH))
   RACDCERT ID(IBMUSER) CONNECT(ID(IBMUSER)                                -
                              LABEL('<IBMUSER Personal Certificate name>') -
                              RING(<keyring name>)                         -
                              DEFAULT                                      -
                              USAGE(PERSONAL))

1. Use the ASCII transfer mode to FTP the zapm.crt certificate to the client.
   The zapm.crt file is a root CA certificate. It is recommended to use your company's approved certificate.
2. Add the zapm.crt certificate to z/OS components machine and connect the zapm.crt certificate to a key ring.
   In the following command examples:

   • - is the continuation character.
   • dsn_name is the data set name that contains the root CA certificate.
   • WITHLABEL('<label>') is optional. The label should be unique, if used.
   • IBMUSER owns the proc. This following command example uses a <keyring name> owned by IBMUSER. For more information about creating a key ring, see RACDCERT ADDRING.

   
   
   RACDCERT CERTAUTH ADD('<dsn_name>') HIGHTRUST WITHLABEL('<label>')
   
   SETROPTS RACLIST(DIGTCERT) REFRESH
   
   RACDCERT ID(IBMUSER) CONNECT(CERTAUTH  LABEL('<label>')        -
                              RING(<keyring name>)                -
                              USAGE(CERTAUTH))
   

Export the z/OS personal certificate for the key ring's owning user ID and add it to the Linux truststore.

1. Export the personal certificate of the z/OS components.

   RACDCERT CERTAUTH EXPORT(LABEL('<unique name>')) DSN('<dsn_export>')
   

2. Add the exported certificate to the existing truststore on the Linux machine where Z APM Connect DG is installed.

   keytool -import -keystore "<truststore>.jks" -deststoretype jks -alias CustomCert -file "<filename>" -storepass "<password>" -keypass "<password>" -noprompt