ICSF is the interface to hardware cryptographic devices. SSH Tectia Server for IBM z/OS
benefits from the higher security and performance that these devices
provide for keys and certificates managed by SAF.
SSH Tectia Server for IBM z/OS also supports SAF keys that do not use hardware crypto
devices, the so-called NON-ICSF keys. For these keys, the cryptographic
operations are performed in software.
The interface to SAF in SSH Tectia Server for IBM z/OS is implemented with an SSH Tectia
External Key Provider. The External Key Providers are configured with
specification strings in a configuration file or on a command
SSH Tectia Server for IBM z/OS validates public keys by matching them against trusted keys
stored in the file system.
SAF does a limited form of certificate checking that only determines
which SAF user is the owner of the certificate. SAF does not check the
contents of the certificate, such as the validity period, or check for
certificate revocation. Instead of revoking a certificate the site can
reduce the user's access rights in SAF.
A trusted key provider must be configured if SAF certificate checking is
to be used.
To enable SAF checking of remote Secure Shell servers, their
certificates can be entered into SAF as SITE keys and placed on a key
ring for the trusted key provider.