SSL for CICS using server certificate

Follow - Create an HFS KEYRING File

Follow - Create a Self-signed Certificate if a Trusted CA is Not Available

Follow - Create a Server Certificate

Note

When creating the Server Certificate, the label name needs special attention. It is not required but it is better to name the label the same as the starting point of the host name: https://cics14.bluezonesoftware.com would have a label of cics14. If both are named the same it will eliminate a dialog box when the URL is accessed.

On the PC, locate the Signing CA certificate on the PC and FTP it to the mainframe using binary or ASCII depending on which option was used when it was exported. FTP to an MVS dataset.

On MVS go to ISPF option 6, ISPF Command Shell and issue the RACF commands:

RACDCERT ID(CICS USERID) ADDRING(RINGNAME)

RACDCERT ID(CICS USERID) CONNECT(CERTAUTH LABEL(‘Signing CA label’) RING(RINGNAME))

RACDCERT ID(CICS USERID) CONNECT(LABEL(‘Server label’) RING(RINGNAME))

Edit the CICS SIP file:

ENCRYPTION=NORMAL, (56 bit) =STRONG (168 bit),

KEYRING=RINGNAME,

SSLDELAY=600,

SSLTCBS=8,

Change the CICS startup JCL making sure the SSL SGSKLOAD data set is available by means of the STEPLIB, JOBLIB unless it is listed the LNKLST IPL parameter.

For the CICS TCPIPSERVICE resource

Set the port number. 684 is the well known port

Set the SSL property to YES