When displaying a Keyring I see a certificate with a label '***All Certificates for User***', is that an actual Certificate LABEL?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

When displaying a Keyring I see a certificate with a label '***All Certificates for User***', is that an actual Certificate LABEL?

Environment

Release:
Component: ACF2MS

Resolution

When displaying a Keyring, a certificate with a label '***All Certificates for User***' is an indication that there is a logical connection of all certificates owned by a logonid.

The ACF CONNECT subcommand is used to associate certificate information with a key ring. When specifying the USER parameter, the connection is a logical connection. Displaying the key ring will indicate that all of the users certificates are connected but will not display the individual record ids. Displaying the users certificate records will not indicate that the certificate is connected to this key ring. 

The USER(logonid) parameter of the CONNECT subcommand specifies a logonid whose certificates will ALL be associated with the specified key ring. This is similar to the way the ALLCA keyword connects all CERTAUTH certificates to a key ring.

Note: Certificates must be trusted to be logically connected to the keyring using the USER parameter.

For example to create a logical CONNECT of all certificates owned by logonid USER001 the following CONNECT command can be issued.

ACF
SET PROFILE(USER) DIV(KEYRING)
CONNECT USER(USER001) KEYRING(MYTEST.RING)

The KEYRING(MYTEST.RING) will show the logical connection for logonid USER001:

ACF
SET PROFILE(USER) DIV(KEYRING)
LIST MYTEST.RING

KEYRING / MYTEST.RING LAST CHANGED BY USER002 ON 04/26/17-08:15  
                    DEFAULT() RINGNAME(MYTEST.RING)              

The following certificates are connected to this key ring:         

CERTDATA record    Label                             Usage        
-----------------  --------------------------------  --------      
CERTAUTH.CERT1     CA ROOT SIGNING CERT              CERTAUTH      
USER001            ***All Certificates for User***   PERSONAL  

To delete/remove a logical connection for a logonid the following command can be issued.

ACF
SET PROFILE(USER) DIV(KEYRING)
REMOVE USER(USER001) KEYRING(MYTEST.RING)