// hi, I'm

Alejandro

I spend most of my time where mainframes meet modern code — RACF, certificates, and crypto on z/OS, with Java, Kotlin and React stacked on top. This is where I keep track of what I'm building and what I've figured out along the way.

$ whoami
alejandro — z/OS security · full-stack · occasional C++ archaeologist
$ cat now.txt
building a native z/OS security library + REST API over it
$ echo $FAVORITE_ENCODING
IBM-1047 # unfortunately
$

What I'm building

zsec — z/OS security, but with an API

A 64-bit native library that wraps RACF administration and System SSL, called through JNI and exposed as a Spring Boot REST API with RACF-backed logins. The goal: manage mainframe security from anywhere that can speak HTTP.

C / JNIRACFSystem SSLSpring Boot

Certificate lifecycle, end to end

Discovering, tracking and renewing certificates across mainframe systems — native engines on z/OS, a central Kotlin backend, a React portal with live updates, and ACME integration for issuing. Lately thinking a lot about post-quantum crypto and what CNSA 2.0 means for all of it.

KotlinReactACMEPKIPQC

Password sync across worlds

A C++ Windows service that keeps passwords in step between Active Directory (across forests) and the mainframe. Lots of COM, ADSI and RACF permission puzzles.

C++Active Directoryz/OS STC

This site

Hand-written HTML on GitHub Pages. Took longer to get DNS right than to write it.

HTMLDNS (humbling)

Toolbox

Mainframe

RACF & keyrings
ICSF & z/OS PKI
AT-TLS
R_datalib / R_admin
USS, JCL, STCs, REXX

Backend

Java & Kotlin
Spring Boot
Native C via JNI
Maven multi-module
Python

Frontend

React
Vite
Tailwind
Server-sent events

Windows

C++ services
C# / WPF
COM & ADSI
Active Directory

Things I learned the hard way

char[61]One byte too short is enough to make an exception throw the wrong class name. Count your null terminators.
UnsatisfiedLinkErrorUsually not your code. Usually LIBPATH.
mkdir XXXXXXmktemp doesn't exist on USS, and the X's won't expand themselves.
EBCDIC ↔ ASCIIEvery encoding bug lives exactly on a boundary. Decide where the boundary is and guard it.
ftp asciiBinary files go over in binary. Every time. No exceptions.

Off the keyboard

Watching soccer, playing games, and always tinkering with some side idea that's probably a bit too ambitious.