EZD1324I

Explanation
 A certificate in the network security server certificate
repository cannot be used to create a digital signature and is not
a Certificate Authority certificate.  A certificate must contain a
private key to be used to create a signature.   
 If a KeyUsage
extension is present in the certificate the digitalSignature bit must
be set.
 To be a Certificate Authority certificate the certificate
must meet one of the following conditions:  The certificate contains a basic constraints extension that indicates
that the subject of this certificate is a Certificate Authority. 
The certificate does not contain a basic constraints extension,
but the certificate is marked as trusted in the certificate repository
and the issuer name in the certificate is equal to the subject name
in the certificate (that is, it is self signed).  

 In the message text: label
The certificate repository label identifying the certificate.

System action
 The certificate is ignored by the network security
services daemon.   Processing continues.

Operator response
 None.

System programmer response
 If this certificate is intended to
be used on behalf of a network security  services (NSS) client to
create a signature, then verify that the private key is stored in
the  certificate repository.  If the private key is not stored in
the repository  remove the certificate from the repository and add
it back to the repository  with its private key.  If the KeyUsage
extension is present in the certificate  and the digitalSignature
bit is not set, the certificate cannot be used to  create a signature.
 A new certificate must be obtained. If this certificate is intended
to be used as a Certificate Authority  certificate and it is self-signed,
then verify that it is marked as trusted.  If  it is not self-signed
then the certificate cannot be used as a Certificate  Authority certificate.
 A new certificate must be obtained.

User response
 None.

Problem determination
 Not applicable.

Source
 z/OS® Communications
Server TCP/IP: Network Security Server

Module
 CertRepository.cpp

Routing code
 10

Descriptor code
 12

Example
  EZD1324I CERTIFICATE ( CERTWITHNOKEY ) CANNOT BE USED TO CREATE A SIGNATURE AND IS NOT A 
    CERTIFICATE AUTHORITY CERTIFICATE