Recommend split keyring for new configurations by pablocarle · Pull Request #4645 · zowe/zowe-install-packaging

pablocarle · 2026-01-05T16:10:30Z

Tests for the changes have been added (for bug fixes / features)
Necessary documentation (if appropriate) have been added / updated
DCO signoffs have been added to all commits, including this PR

PR type

Bugfix

Changes proposed in this PR

Split keyrings into two:

Contains the private key and full chain of the CA used to sign Zowe's certificate.
Contains the trusted certificates (Zowe server chain, z/OSMF certificate, other trusted certificates such as southbound services')

The reason behind it lies in AT-TLS configurations.
Currently, AT-TLS configuration uses keyring to set up handshakes between services; the problem lies in that some connections may be using the PERSONAL certificate from the keyring to authenticate without knowing it, since AT-TLS will pick up certificates marked as DEFAULT.
The chosen way to deal with this is to split the configuration in AT-TLS to have a keyring that contains the private key and another one that only has trusted certificates acting as a truststore.'

This PR aims at updating the recommendations for new installations, since it's not known at the beginning if the installation will use AT-TLS or not.

Documentation is being updated for the AT-TLS article, targeting the 3.4.0 release.

Does this PR introduce a breaking change?

No

Does this PR add or change a YAML parameter?

No

Is there a related doc issue or Pull Request?

Doc issue/PR number:

Other information

Signed-off-by: Pablo Carle <pablo.carle@broadcom.com>

github-actions · 2026-01-05T16:11:57Z

build 9484 SUCCEEDED.
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20721429621

github-actions · 2026-01-05T16:20:07Z

Test workflow 7997 is started.
Running install test: Convenience Pax
The zowe artifact being used by this test workflow: libs-snapshot-local/org/zowe/3.4.0-PR-4645/zowe-3.4.0-pr-4645-9484-20260105161658.pax
Running on machine: zzow09
Result: SUCCESS
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20721634685

files/SZWESAMP/ZWEKRING

arxioly · 2026-01-06T12:51:43Z

files/SZWESAMP/ZWEKRING

 /* Connect the z/OSMF root CA signed by a recognized certificate ... */
 /* authority (CA) with the keyring ................................. */
   RACDCERT CONNECT(CERTAUTH +
            LABEL('&ROOTZFCA.') +
-            RING(&ZOWERING.) USAGE(CERTAUTH)) +
+            RING(&ZOWETRST.) USAGE(CERTAUTH)) +
            ID(&ZOWEUSER.)


Strange that there is nothing about intemediate z/OSMF's certificate at all...

Should we add something? any suggestion?

If you think it make sence, then we could add something similar like for Zowe's:

RACDCERT CONNECT(CERTAUTH + LABEL('&ITRMZFCA.') + RING(&ZOWETRST.) USAGE(CERTAUTH)) + ID(&ZOWEUSER.)

and add new parameter ITRMZFCA in SET section.

files/SZWESAMP/ZWEKRING

Signed-off-by: Pablo Carle <pablo.carle@broadcom.com>

github-actions · 2026-01-06T15:47:21Z

build 9490 SUCCEEDED.
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20753544215

github-actions · 2026-01-06T15:54:51Z

Test workflow 8003 is started.
Running install test: Convenience Pax
The zowe artifact being used by this test workflow: libs-snapshot-local/org/zowe/3.4.0-PR-4645/zowe-3.4.0-pr-4645-9490-20260106155149.pax
Running on machine: zzow10
Result: SUCCESS
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20753724786

Martin-Zeithaml · 2026-01-07T08:16:32Z

files/SZWESAMP/ZWEKRING

 //*********************************************************************
 //* ATTENTION!
 //*
 //* This sample is DEPRECATED.


This sample is kept due to the SMP/E installation. It is deprecated, but updates are of course possible.
Those changes must be reflected in split versions of this sample:

Keyring ACF2

ZWEIKRA1

ZWEIKRA2

ZWEIKRA3

Keyring RACF

ZWEIKRR1

ZWEIKRR2

ZWEIKRR3

Keyring Top Secret

ZWEIKRT1

ZWEIKRT2

ZWEIKRT3

Thank you, I'll bring the updates there

github-actions · 2026-01-07T11:16:31Z

build 9493 SUCCEEDED.
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20779633839

github-actions · 2026-01-07T11:23:00Z

Test workflow 8006 is started.
Running install test: Convenience Pax
The zowe artifact being used by this test workflow: libs-snapshot-local/org/zowe/3.4.0-PR-4645/zowe-3.4.0-pr-4645-9493-20260107111958.pax
Running on machine: zzow10
Result: SUCCESS
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20779766819

Signed-off-by: Pablo Carle <pablo.carle@broadcom.com>

github-actions · 2026-01-08T11:54:31Z

build 9496 SUCCEEDED.
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20815909315

pablocarle · 2026-01-08T11:55:03Z

Based on discussion in z/OS squad call, I made changes to files/SZWESAMP/ZWEIKRA1 as a sample, to discuss if these are appropriate changes, once decided I can port to other files
@Martin-Zeithaml @MarkAckert
cc @1000TurquoisePogs @arxioly

github-actions · 2026-01-08T12:03:28Z

Test workflow 8009 is started.
Running install test: Convenience Pax
The zowe artifact being used by this test workflow: libs-snapshot-local/org/zowe/3.4.0-PR-4645/zowe-3.4.0-pr-4645-9496-20260108115950.pax
Running on machine: zzow09
Result: SUCCESS
Link to workflow run: https://github.com/zowe/zowe-install-packaging/actions/runs/20816080985

Martin-Zeithaml · 2026-01-08T12:47:08Z

files/SZWESAMP/ZWEIKRA1

+//* If truststore is selected, create keyring for it
+//* If truststore is selected, connect z/OSMF certificate to it,
+//* otherwise, connect to keyring
+//IFTRST IF (&IFTRSTST EQ 1) THEN


I am not sure about this:

2 // SET IFTRSTST=0 3 //IF1 IF (&IFTRSTST = 1) THEN IEFC653I SUBSTITUTION JCL - (0 = 1) 4 //IEFBR15 EXEC PGM=IEFBR15 5 // ELSE 6 //IEFBR14 EXEC PGM=IEFBR14 7 // ENDIF

This JCL ended with ABEND806-04, which means an attempt to call IEFBR15 (which does not exist).

Based on the doc, only predefined operands could be used (RC, ABEND, ABENDCC, RUN).

The problem might be in empty lines w/o *.

How can I try out these JCLs?

Running zwe init generate will give you the rendered JCL in your zowe.setup.dataset.jcllib dataset.

recommend split keyring for new installation / configuration

59f05c5

Signed-off-by: Pablo Carle <pablo.carle@broadcom.com>

github-project-automation bot added this to zOS Squad Board Jan 5, 2026

pablocarle temporarily deployed to marist-zzow11 January 5, 2026 16:10 — with GitHub Actions Inactive

zowe-robot temporarily deployed to marist-zzow09 January 5, 2026 16:17 — with GitHub Actions Inactive

arxioly reviewed Jan 6, 2026

View reviewed changes

pr review 1

ca68d85

Signed-off-by: Pablo Carle <pablo.carle@broadcom.com>

pablocarle temporarily deployed to marist-zzow11 January 6, 2026 15:46 — with GitHub Actions Inactive

zowe-robot temporarily deployed to marist-zzow10 January 6, 2026 15:52 — with GitHub Actions Inactive

Martin-Zeithaml reviewed Jan 7, 2026

View reviewed changes

Merge branch 'v3.x/staging' into reboot/keyring-default

e53b7c8

pablocarle temporarily deployed to marist-zzow11 January 7, 2026 11:15 — with GitHub Actions Inactive

zowe-robot temporarily deployed to marist-zzow10 January 7, 2026 11:20 — with GitHub Actions Inactive

proposal for changes in init certificate steps, new schema property

64b7a28

Signed-off-by: Pablo Carle <pablo.carle@broadcom.com>

pablocarle had a problem deploying to marist-zzow11 January 8, 2026 11:53 — with GitHub Actions Failure

zowe-robot temporarily deployed to marist-zzow09 January 8, 2026 12:00 — with GitHub Actions Inactive

Martin-Zeithaml reviewed Jan 8, 2026

View reviewed changes

Conversation

pablocarle commented Jan 5, 2026

PR type

Changes proposed in this PR

Does this PR introduce a breaking change?

Does this PR add or change a YAML parameter?

Is there a related doc issue or Pull Request?

Other information

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pablocarle commented Jan 8, 2026

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 7, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading