IBM Z Software


This portal is to open public enhancement requests against IBM Z Software products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Delivered
Workspace CICS Transaction Server for z/OS
Categories Runtime
Created by Guest
Created on Apr 26, 2012

RELATED IDEAS

CICS Shared RACF KEYRING for SSL Support

The IBM CICS SIT parameter for SSL allow the

KEYRING=userid/keyring

syntax to support shared RACF keyrings.

Specifying a userid/ before the keyring currently generates the following error message:

@nn DFHPA1909 NERPCTSI DATA userid/keyring IS INVALID
FOR KEYWORD KEYRING=. RESPECIFY KEYWORD AND DATA.

The following IBM Redbook,

z/OS Version 1 Release 3 and 4 Implementation
http://www.redbooks.ibm.com/redbooks/pdfs/sg246581.pdf

discusses this support:

15.3 System SSL enhancements in z/OS V1R4
15.3.3 Shared SAF key rings
In z/OS V1R4, support has been added to allow applications to
work with key rings that are not owned by the user ID executing
the application. This is done by specifying the userid/keyring
together, either through the GSK_KEYFILE environment variable or
the gsk_attribute_set_buffer API prior to initializing the SSL
environment. The user of the keyring needs to have UPDATE
authority to the RACF IRR.DIGTCERT facility class. Certificates
that do not belong to the user can only be used for certificate
validation, because the private key is not returned when the
certificate is read from the key ring.

In our RACF database, we have a keyring that is owned by one userid
that contains a signed SITE certificate. This one keyring is being
shared and used for SSL support by a number of our other IBM
applications, including:

IBM HTTP Server
keyfile userid/keyring SAF

IBM Telnet Server (TN3270)
SECUREPORT 992 KEYRING SAF userid/keyring

IBM FTPD Daemon
KEYRING userid/keyring


It would be nice for CICS to also be able to share this
same keyring using the z/OS System SSL services support.

Idea priority High
  • Guest
    Reply
    |     Apr 12, 2024
    Support for keyrings owned by different userids has also been provided in CICS TS 6.2 which has been announced and will GA June 14th 2024.

    See Announcement letter https://www.ibm.com/docs/en/announcements/AD24-0164
  • Guest
    Reply
    |     Mar 30, 2023
    CICS Development: Support for keyrings owned by different userids has been provided by apar PH49253 for CICS TS 5.5 and 5.6 and by apar PH49261 for CICS TS 6.1
  • Guest
    Reply
    |     Mar 22, 2023
    CICS Development: This Idea has been reopened, it is something we would like to address. The Idea is being moved into 'Planned for Future release' status.

    Please note:
    IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion
  • Guest
    Reply
    |     May 6, 2016

    Whilst this requirement is valid, based on our current plans and priorities, it is not likely that this could be implemented in the next 12 months, or in the next CICS TS release. Correspondingly this requirement is being declined at this point. The requirement will be kept in the RFE system and might be reassessed in the future. You also have an opportunity to resubmit in twelve months time if you wish it to be reconsidered then.

  • Guest
    Reply
    |     Oct 5, 2015

    Due to processing by IBM, this request was reassigned to have the following updated attributes:
    Brand - Servers and Systems Software
    Product family - Transaction Processing
    Product - CICS Transaction Server

    For recording keeping, the previous attributes were:
    Brand - WebSphere
    Product family - Transaction Processing
    Product - CICS Transaction Server

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.