03353093 Clear key support not available due to ICSF key policy.

Explanation

Unable to generate clear keys or PKCS #11 objects because of the caller's RACF access to CRYPTOZ class resource CLEARKEY.SYSTOK-SESSION-ONLY or CLEARKEY.token_name not permitting the generation of non-secure (clear) PKCS #11 keys.

User response

Ensure that the user ID of the application has appropriate access to the RACF CRYPTOZ class resource CLEARKEY.SYSTOK-SESSION-ONLY. If using gskkyman, ensure issuer also has access to resource CLEARKEY.token_name. token_name is the name of the PKCS #11 token that is being managed by gskkyman.