Compatibility considerations
Starting with version 8.4, the CCA host library is shared across IBM Z® and non-Z environments.
This means, that there is no longer a suffix z in the version string
returned by queries using verbs CSUACFQ or CSUACFV, as it used to be in
earlier versions, for example, 8.2.54z20240726. Instead, now there is an
f to indicate a FIPS-certified version, or an a
indicating a non-FIPS-certified library version.
However, existing applications running at customer systems may still rely on the CSUACFQ or CSUACFV verbs to return the
z as indicator character.
For example, openCryptoki versions older than 3.25 rely on verb
CSUACFV to return the
z. Otherwise, the openCryptoki
CCA token is not usable at all. Also,
the zkey utility from the s390-tools package relies on verb
CSUACFQ using the STATCCA keyword to
return the version string containing a z. If this indicator is missing or
changed, older versions of zkey are not able to use CCA secure keys.
CCA 8.4 introduces a new
environment variable CSU_S390_VERSION. With this environment variable set to
y, the CSUACFV
and CSUACFQ verbs return the version
using a z. CSUACFQ returns this information when using
keywords STATCCA and STATCCAE.
y, the verbs return the character that is actually contained in
the version string. Users with applications that rely on the indicator being
z, must set this variable with the following command:
export CSU_S390_VERSION=y