AT-TLS enablement for DCAS

With APAR PM96898 installed, z/OS® V2R1 Communications Server enhances the Digital Certificate Access Server (DCAS) to use Application Transparent Transport Layer Security (AT-TLS). To use TLSv1.2 to secure the connection, you must define AT-TLS policies for the DCAS.

Migrate to AT-TLS to allow the DCAS to use the latest support for SSL/TLS. Configuring TLS/SSL by using the DCAS configuration file is supported, but such support is deprecated and will no longer be enhanced.

Dependency: The Policy Agent must be active.

Using AT-TLS enablement for DCAS

To use this DCAS enhancement, perform the appropriate tasks in Table 1.

Table 1. AT-TLS enablement for DCAS
Task/Procedure	Reference
Enable Transparent Transport Layer Security (TTLS) in the TCP/IP stack by specifying the TTLS parameter on the TCPCONFIG statement in the TCPIP profile.	Application Transparent Transport Layer Security data protection in z/OS Communications Server: IP Configuration Guide TCPCONFIG statement in z/OS Communications Server: IP Configuration Reference
Set up authorization for the pasearch command if the command is not issued from a superuser. To set authorization for the pasearch command, create a SERVAUTH profile of `EZB.PAGENT.sysname.TcpImage.ptype`. The `ptype` value can be set to TTLS or a wildcard value.	Steps for configuring the Policy Agent in z/OS Communications Server: IP Configuration Guide z/OS Security Server RACF Security Administrator's Guide
Enable AT-TLS configuration for the Policy Agent by specifying CommonTTLSConfig, TLSConfig, or both statements in the Policy configuration file for each stack.	Policy-based networking and Application Transparent Transport Layer Security data protection in z/OS Communications Server: IP Configuration Guide CommonTTLSConfig statement and TTLSConfig statement in z/OS Communications Server: IP Configuration Reference
Define the AT-TLS policies by specifying the policies in the configuration files that are identified with the CommonTTLSConfig and TTLSConfig statements.	Specify the AT-TLS policies in the configuration files that are identified with the CommonTTLSConfig and TTLSConfig statements. Use one of the following methods to create the AT-TLS Policy Agent configuration files: Use the IBM® Configuration Assistant for z/OS Communications Server. Through a series of wizards and online help panels, you can use a GUI to produce the Policy Agent configuration files for any number of TCP/IP stacks. Using the GUI can reduce the amount of time that is required to produce configurations and reduce chances of configuration errors. Code the required statements into a z/OS UNIX file or MVS™ data set.
Display policy-based networking information by using the z/OS UNIX System Services (USS) pasearch command to query information from the z/OS UNIX Policy Agent. The command is issued from the USS shell.	Displaying policy-based networking information in z/OS Communications Server: IP System Administrator's Commands
Enable AT-TLS in the DCAS configuration file by setting TLSMECHANISM to ATTLS.	Customizing DCAS for TLS/SSL in z/OS Communications Server: IP Configuration Guide