Does ACF2 support SHA-2 certificates?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

Does ACF2 support SHA-2 certificates?

 

Environment

Release: ACF2..001AO-15-ACF2
Component:

Resolution

ACF2 supports the creation of SHA-2 certificates as well as the insertion of SHA-2 certificates.

SHA-2 SSL certificate hashing is a cryptographic algorithm developed by the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA). 

 

SHA2 certificates are more secure than all previous algorithms. SHA-2 is a set of cryptographic hash functions 224, 256, 384 or 512 bits. 

TLS 1.2 includes SHA-2 cryptographic hash functions. CA ACF2 supports both SHA-1 and SHA-2. 

 

The signing algorithm is only used when a certificate is signed. The CA ACF2 GENCERT command is used to sign certificates. The GENCERT HASHALG(SHA1|SHA256) parameter overrides the signing algorithm to be used. SHA1 and SHA256 are the possible values. The signature algorithm of an existing certificate cannot be changed, the certificate must be re-signed(GENCERT).  CA ACF2 can be used to create a certificate that is signed with SHA-256 which is one of the SHA-2 signing algorithms.  CA ACF2 support certificates from External CAs that use any of the SHA-2 signing algorithms(hash functions 224, 256, 384 or 512 bits). 

Example:

Using the TSO ACF GENCERT command to create a certificate with SHA256: 

ACF 

GENCERT CERTSHA2.CERT SUBJ(CN='MySHA2' -
OU='My Audit Department' O='Company Name' C=US) -
LABEL(SHA2 CA) HASHALG(SHA256) SIZE(2048) 

 CERTDATA / CERTSHA2.CERT LAST CHANGED BY USER002 ON 06/16/15-09:54          
            CERTNSER(0000000000000001) ISSUERDN(CN=MySHA2.OU=My Audit
            Department.O=Company Name.C=US) KEYSIZE(2,048)        
            LABEL(SHA2 CA) SERIAL#(00) SUBJDN(CN=MySHA2.OU=My Audit D
            epartment.O=Company Name.C=US) TRUST                     

 Certificate is not connected to any key rings                                

ACF                                                                       

chkcert CERTSHA2.CERT                                            

Label:                                                        
    SHA2 CA                                                    
Serial number:                                                
    00                                                        
Issuer's distinguished name:                                  
    CN=MySHA2                                                  
    OU=My Audit Department                                    
    O=Company Name                                            
    C=US                                                      
Subject's distinguished name:                                  
    CN=MySHA2                                                  
    OU=My Audit Department                                    
    O=Company Name                                            
    C=US                                                      
Not valid before:                                              
   2015/06/16  00:00:00 UTC                                  
Not valid after:                                              
    2016/06/16  23:59:59 UTC                                  
Private Key Type:                                              
    RSA                                                        
Private key bit size:                                          
    2048                                                      
Signature Algorithm:                                          
    sha256WithRSAEncryption                                    

This certificate is registered with CA ACF2                    

The CERTDATA record key is CERTSHA2.CERT        
 CERTDATA / CERTSHA2.CERT LAST CHANGED BY USER002 ON 06/16/15-09:54          
            CERTNSER(0000000000000001) ISSUERDN(CN=MySHA2.OU=My Audit
            Department.O=Company Name.C=US) KEYSIZE(2,048)        
            LABEL(SHA2 CA) SERIAL#(00) SUBJDN(CN=MySHA2.OU=My Audit D
            epartment.O=Company Name.C=US) TRUST