SFTP batch from z/OS - client certificate rotation procedure

Hello everyone,

Our interface team transfers daily settlement files from z/OS to an external partner using batch SFTP. The partner will rotate their server certificate next month. Current JCL invokes:

jcl
//SFTP EXEC PGM=BPXBATCH,
// PARM='SH /usr/lpp/ssh/bin/sftp -oBatchMode=yes \
//     -b //DD:CMDS partner.example.com'
//CMDS DD *
put '//DD:INPUT' /inbound/settlement.dat
quit

The partner documentation states:

Clients must trust the new intermediate CA before the cutover window. Connections using the previous trust anchor will fail with certificate validation errors.

Thank you,
Susan

We add the new certificate to a parallel key ring, run a test SFTP job against the partner test endpoint, then swap the key ring reference in production JCL on cutover night. Old certificate remains until partner confirms decommission.

Follow-up: did your security team require a formal change record for the RACF key ring update alone, or was it bundled with the partner change ticket?

Separate change record for RACF. Partner cutover is dependent on it. Makes rollback cleaner if validation fails.