Before you begin

1.2.3.4

http://www.mycompany
   .com/cps.html 

Procedure

Perform the following steps to update the pkiserv.conf configuration file:

1. If necessary, update the ObjectStore section:
   1. If you want to use DB2 tables for the object store and issued certificate list (ICL) instead of VSAM files, uncomment the following line by removing the "# " at the beginning of the line:

      # DBType=DB2

      and leave the following line commented out:

      # DBType=VSAM

      If you want to use VSAM files, leave both lines commented out, or uncomment the following line:

      # DBType=VSAM

   2. If DBType is set to DB2 (see step 1.a), uncomment the following lines, and if necessary change the DB2 package name and subsystem name in the following lines to the names you chose in the DBPackage and DBSubsystem rows in Table 1:

      # DBPackage=MasterCA
      
      # DBSubsystem=DSN9

   3. If DBType is set to VSAM, or commented out, or not present (see step 1.a), if necessary change the data set names in the following lines to the names you chose in the ObjectDSN, ObjectTidDSN, ObjectStatusDSN, ObjectRequestorDSN, ICLDSN, ICLStatusDSN, and ICLRequestorDSN rows in Table 1:

      ObjectDSN='pkisrvd.vsam.ost' 
      ObjectTidDSN='pkisrvd.vsam.ost.path' 
      ObjectStatusDSN='pkisrvd.vsam.ost.status' 
      ObjectRequestorDSN='pkisrvd.vsam.ost.requestr 
      ICLDSN='pkisrvd.vsam.icl' 
      ICLStatusDSN='pkisrvd.vsam.icl.status' 
      ICLRequestorDSN='pkisrvd.vsam.icl.requestr' 

      If you are configuring PKI Services for the first time be aware that the high-level qualifier of the VSAM data set names must match the name of the RACF user ID assigned to the PKI Services daemon (by default, PKISRVD). If you change from the default to another user ID, you need to change the high-level qualifier in the pkiserv.conf configuration file as well. If the MVS programmer changes the data set names (see Step 2.d), you must make equivalent changes in pkiserv.conf.

   4. If necessary, change 1w in the following line to the value in the RemoveCompletedReqs row in Table 1:

      RemoveCompletedReqs=1w

   5. If necessary, change 4w in the following line to the value in the RemoveInactiveReqs row in Table 1:

      RemoveInactiveReqs=4w

   6. If necessary, uncomment the following line and, optionally, change 26w to the value in the RemoveExpiredCerts row in Table 1:

      RemoveExpiredCerts=26w

   7. If necessary, uncomment the following line and, optionally, change 520w to the value in the RemoveExpiredCertsAndKeys row in Table 1:

      RemoveExpiredCertsAndKeys=520w

   8. If necessary, update the SharedPLEX line:
      • If you intend to use a sysplex and you are configuring PKI Services for the first time, change F in the following line to T:

        SharedPLEX=F

      • If you are not using a sysplex (regardless of whether you are configuring PKI Services for the first time), you do not need to do anything.

   _______________________________________________________________

2. If necessary, update the CertPolicy section.
   1. If necessary, change 3m in the following line to the value in the CreateInterval row in Table 1:

      CreateInterval=3m

   2. If necessary, update the ExpireWarningTime line(s):
      • If you are sending e-mail notifications and you are configuring PKI Services for the first time, if necessary change the value 4w in the following line to the value in the ExpireWarningTime row of Table 1.

        ExpireWarningTime=4w

      • If you are not using e-mail notifications and you are configuring PKI Services for the first time, remove the ExpireWarningTime=4w line from the pkiserv.conf file.
   3. If necessary, change 1d in the following line to the value in the TimeBetweenCRLs row in Table 1:

      TimeBetweenCRLs=1d

   4. If necessary, change 2d in the following line to the value in the CRLDuration row in Table 1:

      CRLDuration=2d

   5. If necessary, change F in the following line to the value in the PolicyRequired row in Table 1:

      PolicyRequired=F

      For more information on this parameter, see Using certificate policies.
   6. If necessary, change F in the following line to the value in the PolicyCritical row in Table 1:

      PolicyCritical=F

      For more information on this parameter, see Using certificate policies.
   7. If necessary, change 120d in the following line to the value in the MaxSuspendDuration row in Table 1:

      MaxSuspendDuration=120d

   8. If necessary, establish distribution point (DP) certificate revocation lists (CRLs) and a DP authority revocation list (ARL). Follow the procedure shown in Steps for customizing distribution point CRLs to determine the values for Table 1.
   9. If you wish to enable the OCSP responder, change OCSPType=none to OCSPType=basic.
   10. If you want to allow certificate management protocol (CMP) clients to send requests to PKI Services, change EnableCMP=F to EnableCMP=T. For information about support for CMP, see Using the certificate management protocol (CMP) with PKI Services.
   11. If you want to enable support for CRLs larger than 32KB, change F in the following row to T and set LargeCRLPostPath to the full path of the file system directory where PKI Services is to save CRLs for posting to LDAP.

       EnableLargeCRLPosting=F

       For more information, see Enabling support for large CRLs.
   12. If you want certificate revocation lists (CRLs) to be created without the Issuing Distribution Point (IDP) extension, uncomment the following line by removing the "#" character and change T to F:

       #IDPExtCRL=T

   13. If you wish to enable Simple Certificate Enrollment Protocol (SCEP), change EnableSCEP=F to EnableSCEP=T. (See Enabling Simple Certificate Enrollment Protocol (SCEP).)
   14. If you want to enable granular authority control for administration functions, uncomment the following line by removing the "#" character and change F to T:

       #AdminGranularControl=F

       Before you enable granular authority control, the security administrator must set up profiles in the PKISERV class to control which functions each PKI administrator can perform. For more information, see Using the PKISERV class to control access to administrative functions.
   15. If you want to enable certificate path length constraint, uncomment the following line by removing the "#" character and change F to T:

       #EnablePathLenConstraint=F

       Then uncomment the following line by removing the "#" character and change 1 to the value that you want the pathLenConstraint field to be set to in the basic constraints extension of intermediate CA certificates created by the CA. The value that you specify must be in the range 0 - 16, and must be less than the value of pathLenConstraint in the PKI CA certificate if it is present.

       #PathLength=1

   _______________________________________________________________

3. If you want a console message to be issued when CRL processing finishes, change the following line

   CRLWTONotification=none

   to

   CRLWTONotification=file

   _______________________________________________________________
4. If necessary, update the General section:
   1. If necessary, change 10 in the following line to the value in the InitialThreadCount row in Table 1:

      InitialThreadCount=10 

   2. If necessary, change 10 in the following line to the value in the ExitTimeout row in Table 1:

      ExitTimeout=30s 

   3. If you choose, you can customize the time at which the daily maintenance task runs, the days on which it runs, and whether it also runs when the PKI Services daemon starts. This task is named daily_Timer, and performs functions such as:
      • Removing old and expired certificates
      • Removing inactive and completed certificate requests from the object store
      • Updating the low CRL distribution point based on expired certificates
      • Processing certificate expiration notification warning messages and automatic certificate renewal messages
      To specify that the daily maintenance task is to run at a time other than the default of midnight local time, remove the "#" from the following line and change 01:00 to the time that you want the task to run.

      #MaintRunTime=01:00

      To specify the days on which the daily maintenance task is to run, remove the "#" from the following line and change 0123456 to the list of digits representing the days on which you want the task to run. For example, specify 15 to run the task every Monday and Friday.

      #MaintRunDays=0123456

      To specify that the daily maintenance task is not to run when the PKI Services daemon starts, remove the "#" from the following line and change T to F.

      #RunMaintAtStart=T

   4. If necessary update the ReadyMessageForm, RejectMessageForm, ExpiringMessageForm, AdminNotifyForm, RenewCertForm, and RecoverForm lines:
      • If you are sending e-mail notifications and you are configuring PKI Services for the first time, if necessary, change the values of the path name in the following lines to the corresponding values in Table 1:

        ReadyMessageForm=/etc/pkiserv/readymsg.form
        
        RejectMessageForm=/etc/pkiserv/rejectmsg.form
        
        ExpiringMessageForm=/etc/pkiserv/expiringmsg.form
        
        AdminNotifyForm=/etc/pkiserv/pendingmsg.form
        
        RenewCertForm=/etc/pkiserv/renewcertmsg.form 

      • If you are allowing PKI Services to generate key pairs for certificates, if necessary change the value of the path name in the following lines to the corresponding value in Table 1:

        ReadyMessageForm=/etc/pkiserv/readymsg.form
        
        RecoverForm=/etc/pkiserv/recoverymsg.form

      • If you are not sending e-mail notifications and you are configuring PKI Services for the first time, comment out the following lines in the pkiserv.conf configuration file by putting a "#" character in the first position of each line that does not already have a "#" character in it, as shown here:

        # full pathname or data set name containing the 'your certificate request        
        # has been rejected' message form. Defaults to no message issued                 
        # RejectMessageForm=/etc/pkiserv/rejectmsg.form                                    
        
        # full pathname or data set name containing the 'your certificate is about       
        # to expire' message form. Defaults to no message issued                         
        # ExpiringMessageForm=/etc/pkiserv/expiringmsg.form                                
        
        # full pathname or data set name containing the ‘request(s) pending for          
        # approval’ message form. Defaults to no notification sent                       
        # AdminNotifyForm=/etc/pkiserv/pendingmsg.form                                     
        
        # full pathname or data set name containing the renewed certificate.             
        # Defaults to no certificate sent                                                
        # RenewCertForm=/etc/pkiserv/renewcertmsg.form                                     

      • If you are not sending e-mail notifications and you are not allowing PKI Services to generate keys for certificates, and you are configuring PKI Services for the first time, comment out the following lines in the pkiserv.conf configuration file, as shown here:

        # full pathname or data set name containing the 'your certificate is ready'      
        # message form. Defaults to no message issued                                    
        # ReadyMessageForm=/etc/pkiserv/readymsg.form                                      

      • If you are not allowing PKI Services to generate keys for certificates, and you are configuring PKI Services for the first time, comment out the following lines in the pkiserv.conf configuration file, as shown here:

        # full pathname or data set name containing information on certificate(s)
        # needed to be recovered.
        # RecoverForm=/etc/pkiserv/recoverymsg.form                                    

      • If you are allowing PKI Services to generate keys for certificates, and you are not configuring PKI Services for the first time, and you previously deleted the following lines in the pkiserv.conf configuration file, restore the following lines:

        # full pathname or data set name containing the 'your certificate is ready'      
        # message form. Defaults to no message issued                                    
        ReadyMessageForm=/etc/pkiserv/readymsg.form                                      

   _______________________________________________________________

5. If necessary, update the SAF section:
   1. If necessary, change PKISRVD/CAring in the following line to the value in the KeyRing row in Table 1:

      KeyRing=PKISRVD/CAring

   2. If you specified EnableSCEP=T in Step 2.m, change Local PKI RA in the following line to the value in the ra_label row in Table 1:

      RALabel=Local PKI RA

   3. If you want PKI Services to be able to generate and store key pairs for certificate requests, and the ICSF programmer has set up the ICSF PKCS #11 token data set (TKDS), uncomment the following line and change PKISRVD.PKIToken to the value you chose in the TokenName row in Table 1:

      TokenName=PKISRVD.PKIToken

   _______________________________________________________________

6. Restart PKI Services. Your changes do not take effect until you do this. For information about starting PKI Services see Starting and stopping PKI Services.

   _______________________________________________________________