IBM z/OS Management Facility (z/OSMF)

 Has anyone had z/OSMF on z/OS 3.1working with Elliptic curve certificates?

Colin Paice's profile image
Colin Paice IBM Champion posted Wed January 22, 2025 04:13 PM

If I use RSA certificates, z/OSMF comes up fine.  If I use an elliptic curve it hangs.

I'm running with -Djavax.net.debug=all , the last line of output is

|SunX509KeyManagerImpl.java:392|matching alias: CCPEC256         

then it times out.

The certificate and ring work fine with AT-TLS.

I defined my certificate with

RACDCERT ID(IZUSVR) GENCERT - 
  SUBJECTSDN(CN('10.1.1.2') - 
             O('NISTEC256') - 
             OU('IZU')) - 
   ALTNAME(IP(10.1.1.2))- 
   NISTECC - 
   KEYUSAGE(   HANDSHAKE     )  - 
   SIZE(256 ) - 
   SIGNWITH (CERTAUTH LABEL('DOCZOSCA')) - 
   WITHLABEL('CCPEC256') 

Ive tried many things, self signed, different CAs etc.  But nothing works with my EC curves.

Does anyone have a Elliptic Curve certificate definition which works, which they would be willing to share?