Obtaining a client certificate

Provisioning Guide for Mainframe Systems for VSP One Block 85
Version
10.5.x
File Size
1619 KB
Audience
anonymous
Part Number
MK-26VSP1B034-03
ft:lastEdition
2026-06-23

When you use the FICON® encryption functions, make sure to register a client certificate on the storage system and the key management servers.

Note: For more information about how to register the client certificate on the key management server, see the manual for the key management server.

The following describes the procedure for obtaining a client certificate. The client certificate can be obtained using maintenance utility or the openssl command. For details about each step, see the System Administrator Guide.

Step Procedure overview Management tool or command to use
1 Create a private key (.key file). Maintenance utility or the openssl command
2 Create a public key (.csr file). Maintenance utility or the openssl command
3

Obtain a signed certificate.

(The file name (.crt file) of the public key signed by the Certificate Authority)

 N/A
4 Convert to the PKCS#12 format (.p12 file). openssl command

Install OpenSSL downloaded from the OpenSSL website (https://www.openssl.org/) in the C:\openssl directory on your Windows computer.

Note: C:\Key in the following procedure indicates the work directory. Specify your work directory name for C:\Key if you perform the operations in a different directory.
  1. Create a private key (.key file).

    For more information, see the System Administrator Guide.

    When you use maintenance utility, select Use Fibre Channel Endpoint Security for Mainframe in the Create CSR and Self-Signed Certificate window.

  2. Create a public key (.csr file).

    For more information, see the System Administrator Guide.

    • When you use maintenance utility, select Use Fibre Channel Endpoint Security for Mainframe in the Create CSR and Self-Signed Certificate window.
    • When you use the openssl command, in the Subject Alternative Names, specify the WWNN of the storage system to be used by replacing AB:CD:EF:01:23:45:67:89 with the actual WWNN value in the following format: otherName = 1.2.840.114402.1.1.1;UTF8:AB:CD:EF:01:23:45:67:89

      Notes on the format above:

      • 1.2.840.114402.1.1.1 indicates OID (Object Identifier) that is followed by a WWNN.
      • UTF8 indicates the encode type.
      • AB:CD:EF:01:23:45:67:89 indicates a WWNN of the storage system.

        The WWNN of the storage system is displayed when you select Use Fibre Channel Endpoint Security for Mainframe in the Create CSR and Self-Signed Certificate window.

    Notes on step 2:

    • The public key created onmaintenance utility can be customized by using the openssl command.
    • The following are examples of using the openssl command:
      • A file name of a public key to be created: client.csr
      • A file name of a private key that has been created: client.key
      • A name of a file that describes the setting values of the public key to be created: req.txt

      Run the following command from a Windows command prompt: 

      C:\key>openssl req -new -sha256 -nodes -out c:\key\client.csr -keyout c:\key\client.key -config c:\key\req.txt

      The following is an example of req.txt:

      [ req ] 
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
C = JP
ST = Kanagawa
L = Odawara
O = Hitachi
OU = ITPD
CN = 192.168.0.1
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
otherName =
1.2.840.114402.1.1.1;UTF8:AB:CD:EF:01:23:45:67:89
  3. Send the public key to a trusted Certificate Authority to obtain a signature from the Certificate Authority.

    Notes:

    • Use the public key signed by the Certificate Authority as the client certificate registered on the key management servers.
    • Certificate Authorities are VeriSign and others.
  4. Convert the private key obtained in step 1 and the public key signed by the Certificate Authority in step 3 to a client certificate in the PKCS#12 format (.p12 file).

    Notes:

    • The following are examples of converting to the PKCS#12 format:
      • A file name of a public key signed by a Certificate Authority: client.crt
      • A file name of a private key: client.key
      • A file name of a client certificate in the PKCS#12 format: client.p12

      Run the following command from a Windows command prompt:

      C:\key>c:\openssl\bin\openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12
    • The following characters are allowed for the password for the private key:
      • Number of characters: up to 128 characters
      • One-byte alphanumeric characters (case-sensitive) and symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~