RACF® supports signing and verification of program objects. This means that IBM® or a vendor can ship program objects containing a digital signature (including the digital certificate chain for the user who performed the program bind). An installation can then choose to verify the integrity of these program objects (for example, the System SSL modules) when they are loaded into virtual storage.

Installations that choose to use signature verification experience some performance overhead when the signature of a signed program object is verified before being loaded into memory. However, most of this overhead is from validating the certificate chain that was used during the signing process and can be lessened using the virtual lookaside facility (VLF) to cache certificates after they are validated. Most of the overhead from validating a certificate chain is then incurred only once, the first time a program object from a particular signer is loaded. Subsequent calls to load any program object from the same signer is able to avoid the performance overhead.

For information about enabling VLF caching, see VLF considerations for program signature verification. For information about initializing program signature verification, see Initializing RACF verification of signed programs (IRRVERLD). For implementation details, see "Enabling RACF to verify signed programs" in z/OS Security Server RACF Security Administrator's Guide.