Authorized applications, such as servers, that invoke the R_PKIServ callable service (IRRSPX00) can request the generation, retrieval, and administration of PKIX-compliant X.509 Version 3 certificates and certificate requests. Applications can request end-user functions or administrative functions related to these requests. You authorize these applications by administering RACF resources in the FACILITY class, based on whether the application requests end-user functions or administrative functions.

You can authorize access to administrative functions on a more granular level using resources in the RACF PKISERV class. The PKISERV class profiles are checked in addition to the FACILITY class profiles.

See z/OS Security Server RACF Callable Services for the details of invoking IRRSPX00.