When you enter or change the PKA master keys or the ASYM-MK, you must first disable the PKA services. To enable or disable PKA services:

1. Access the administrative control functions by choosing option 4, ADMINCNTL, on the Primary Menu panel, as shown in Figure 62.
   Figure 62. Selecting Administrative Control on the ICSF Primary Menu Panel

    CSF@PRIM --------- Integrated Cryptographic Service Facility -------
    OPTION ===> 4
   
    Enter the number of the desired option.
   
      1  COPROCESSOR MGMT    -  Management of Cryptographic Coprocessors
      2  MASTER KEY MGMT     -  Master key set or change, CKDS/PKDS processing
      3  OPSTAT              -  Installation options
      4  ADMINCNTL           -  Administrative Control Functions
      5  UTILITY             -  ICSF Utilities
      6  PPINIT              -  Pass Phrase Master Key/KDS Initialization
      7  TKE                 -  TKE Master and Operational key processing
      8  KGUP                -  Key Generator Utility processes
      9  UDX MGMT            -  Management of User Defined Extensions
   
   
          Licensed Materials - Property of IBM
   
         5694-A01 (C) Copyright IBM Corp. 1990, 2011. All rights reserved.
         US Government Users Restricted Rights - Use, duplication or
         disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
   
    Press ENTER to go to the selected option.
    Press END   to exit to the previous menu.
    

   The Administrative Control Function panel appears. See Figure 63.

   Figure 63. Enabling and Disabling the PKA Callable Services

    CSFACF00 ------------- ICSF Administrative Control Functions
    COMMAND ===>
             Active CKDS: CRYPTO25.HCR7704.CKDS
             Active PKDS: CRYPTO25.HCR7704.PKDS
             Active TKDS: CRYPTO25.HCR7704.TKDS
   
   To change the status of a control, enter the appropriate character
   (E - ENABLE, D - DISABLE) and press ENTER.
   
            Function                                 STATUS
            --------                                 ------
    .  Dynamic CKDS Access                           ENABLED 
    .  PKA Callable Services                         ENABLED  
    .  Dynamic PKDS Access                           ENABLED
      

2. Enter the appropriate character and press ENTER.
   • To enable the PKA callable services, enter an 'E' before the PKA Callable Services function.
     Note:

     If using a PKDS, you must also enable Dynamic PKDS Access.
   • To disable the PKA callable services, enter a 'D' before the PKA Callable Services function.
     Note:

     Disabling PKA callable services also disables Dynamic PKDS Access.