Authorized applications, such as servers, that invoke the R_PKIServ callable service (IRRSPX00) can request the generation, retrieval, and administration of PKIX-compliant X.509 Version 3 certificates and certificate requests. Applications can request end-user functions or administrative functions related to these requests. You authorize these applications by administering RACF® resources in the FACILITY class, based on whether the application requests end-user functions or administrative functions.

See z/OS Security Server RACF Callable Services for the details of invoking IRRSPX00.