Certificates - Revision history

Niklas Edmundsson (HPC2N): Swestore documentation moved

2023-02-08T13:02:01Z

Swestore documentation moved

Jens Larsson (NSC): Redirected page to Grid certificates

2011-10-27T14:59:05Z

Redirected page to Grid certificates

Jens Larsson (NSC): /* Getting a certificate */

2011-10-27T14:57:03Z

‎Getting a certificate

Jens Larsson (NSC): /* IMPORTANT */

2011-10-27T14:56:02Z

‎IMPORTANT

Jens Larsson (NSC) at 14:50, 27 October 2011

2011-10-27T14:50:31Z

Joel Hedlund (NSC) at 13:07, 28 September 2011

2011-09-28T13:07:35Z

Joel Hedlund (NSC) at 07:31, 23 September 2011

2011-09-23T07:31:51Z

Torben Rasmussen (NSC) at 13:17, 8 July 2011

2011-07-08T13:17:58Z

Torben Rasmussen (NSC) at 13:37, 17 June 2011

2011-06-17T13:37:00Z

Jens Larsson (NSC): Import from the SNIC Plone page

2011-02-17T14:11:26Z

Import from the SNIC Plone page

New page

=Certificates=

==Introduction==

In order to get access to computel and storage resources on the grid, you must have a valid grid client certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource. There is no need for a special account/username, everything is resolved through the unique certificate id.

==IMPORTANT==

* The grid certificate consists of 2 files located at ~/.globus at the host(s) from where you will be accessing resources:
usercert.pem -- grid certificate
userkey.pem -- the private key, be careful with this file.
* The certificate is personal and only bound to you as a person (it consists of a name, organisation and an e-mail address). It is not bound to a specific machine or a user name.
* The certificate is valid for 1 year only, after that it must be renewed again.
* The private key is encrypted using a password of your choice. Anyone that can decrypt this private key will be able to authenticate as you wherever this grid certificate is used as authentication (the public key, on the other hand, is public, and may be readable by others).
* The private key should therefore be handled with great care. On every machine that it exists it must only be readable by you (i.e. ``chmod 400 userkey.pem''). Any transferring of the private key between computers must only be done using encryption (such as scp, sftp, rsync over ssh, etc.).
* You must choose a strong password for the private key. This password must not be used anywhere else and should not be easily cracked. You must never ever give away the password to somebody else.

For more information regarding certificates and public key cryptography:

[http://en.wikipedia.org/wiki/Public-key_cryptography http://en.wikipedia.org/wiki/Public-key_cryptography]
[http://en.wikipedia.org/wiki/Public_key_certificate http://en.wikipedia.org/wiki/Public_key_certificate]

==Getting a certificate==

For details: [http://ca.nordugrid.org http://ca.nordugrid.org]

For many details: [http://www.nordugrid.org/documents/certificate_howto.html http://www.nordugrid.org/documents/certificate_howto.html]

Another description: [http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate]

==Cheat Sheet==
Create a certificate request together with a private key by executing the following in the terminal on the machine you have logged in to:

grid-cert-request -interactive

# Come up with a strong pass phrase that is used to encrypt the private key (write it down and keep it at a secure place, e.g. your wallet).
# Press the ENTER key when asked about the questions about "Level 0 Organization Name" and "Level 1 Organization Name" (i.e. they should be left unaltered as "Grid" and "Nordugrid").
# The domain is the part of your department's e-mail address after '@': MISU users should write the following as "Your Domain": misu.su.se and SMHI users should write the following as "Your Domain": smhi.se
# Fill in your name. WARNING: only ASCII characters are valid, for example 'å','ä' and 'ö' are not valid and should be replaced with their ASCII-equivalents.
# Fill in your e-mail address used at work.

When finished, something like the following should be displayed:

A private key and a certificate request has been generated with the subject:
/O=Grid/O=NorduGrid/OU=nsc.liu.se/CN=Jens Larsson/Email=jens@nsc.liu.se

Send it to the local Registration Authority (RA) if any or directly to the Nordugrid CA at [mailto:ca@nordugrid.org ca@nordugrid.org]

==Getting a certificate without grid-cert-request==

If you don't have the grid tools available for creating the CSR, you can use OpenSSL directly. Modify OU and CN as necessary.

openssl req -new -newkey rsa:2048 \
-out usercert_request.pem -keyout userkey.pem \
-subj "/O=Grid/O=NorduGrid/OU=nsc.liu.se/CN=Kalle Kula/emailAddress=kalle@nsc.liu.se"

← Older revision		Revision as of 13:02, 8 February 2023
Line 1:		Line 1:
−	#REDIRECT [[~~Grid certificates~~]]	+	#REDIRECT[[Swestore Documentation Moved]]

← Older revision		Revision as of 14:59, 27 October 2011
Line 1:		Line 1:
−	[[~~Category:~~Grid ~~computing~~]]	+	#REDIRECT [[Grid certificates]]
−	~~[[Category:SweStore]]~~
−	~~[[Category:SweStore user guide]]~~
−	~~=Certificates=~~
−
−	~~==Introduction==~~
−
−	In order to get access to computel and storage resources on the grid, you must have a valid grid client certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource. There is no need for a special account/username, everything is resolved through the unique certificate id.

← Older revision		Revision as of 14:57, 27 October 2011
Line 7:		Line 7:

	In order to get access to computel and storage resources on the grid, you must have a valid grid client certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource. There is no need for a special account/username, everything is resolved through the unique certificate id.		In order to get access to computel and storage resources on the grid, you must have a valid grid client certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource. There is no need for a special account/username, everything is resolved through the unique certificate id.
−
−	~~==Getting a certificate==~~
−
−	~~For details: [http://ca.nordugrid.org http://ca.nordugrid.org]~~
−
−	~~For many details: [http://www.nordugrid.org/documents/certificate_howto.html http://www.nordugrid.org/documents/certificate_howto.html]~~
−
−	~~Another description: [http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate]~~

← Older revision		Revision as of 14:56, 27 October 2011
Line 7:		Line 7:

	In order to get access to computel and storage resources on the grid, you must have a valid grid client certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource. There is no need for a special account/username, everything is resolved through the unique certificate id.		In order to get access to computel and storage resources on the grid, you must have a valid grid client certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource. There is no need for a special account/username, everything is resolved through the unique certificate id.
−
−	~~==IMPORTANT==~~
−
−	* The grid certificate consists of 2 files located at ~/.globus at the host(s) from where you will be accessing resources:
−	~~usercert.pem -- grid certificate~~
−	~~userkey.pem -- the private key, be careful with this file.~~
−	* The certificate is personal and only bound to you as a person (it consists of a name, organisation and an e-mail address). It is not bound to a specific machine or a user name.
−	* The certificate is valid for 1 year only, after that it must be renewed again.
−	* The private key is encrypted using a password of your choice. Anyone that can decrypt this private key will be able to authenticate as you wherever this grid certificate is used as authentication (the public key, on the other hand, is public, and may be readable by others).
−	* The private key should therefore be handled with great care. On every machine that it exists it must only be readable by you (i.e. ``chmod 400 userkey.pem''). Any transferring of the private key between computers must only be done using encryption (such as scp, sftp, rsync over ssh, etc.).
−	* You must choose a strong password for the private key. This password must not be used anywhere else and should not be easily cracked. You must never ever give away the password to somebody else.
−
−	~~For more information regarding certificates and public key cryptography:~~
−
−	~~[http://en.wikipedia.org/wiki/Public-key_cryptography http://en.wikipedia.org/wiki/Public-key_cryptography]~~
−	~~[http://en.wikipedia.org/wiki/Public_key_certificate http://en.wikipedia.org/wiki/Public_key_certificate]~~

	==Getting a certificate==		==Getting a certificate==

← Older revision		Revision as of 14:50, 27 October 2011
Line 31:		Line 31:

	Another description: [http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate]		Another description: [http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate http://www.nsc.liu.se/systems/storage.html#Getting%20a%20Grid%20Certificate]
−
−	~~==Cheat Sheet==~~
−	~~Create a certificate request together with a private key by executing the following in the terminal on the machine you have logged in to:~~
−
−	~~grid-cert-request -interactive~~
−
−	~~# Come up with a strong pass phrase that is used to encrypt the private key (write it down and keep it at a secure place, e.g. your wallet).~~
−	~~# Press the ENTER key when asked about the questions about "Level 0 Organization Name" and "Level 1 Organization Name" (i.e. they should be left unaltered as "Grid" and "Nordugrid").~~
−	# The domain is the part of your department's e-mail address after '@': MISU users should write the following as "Your Domain": misu.su.se and SMHI users should write the following as "Your Domain": smhi.se
−	~~# Fill in your name. WARNING: only ASCII characters are valid, for example 'å','ä' and 'ö' are not valid and should be replaced with their ASCII-equivalents.~~
−	~~# Fill in your e-mail address used at work.~~
−
−	~~When finished, something like the following should be displayed:~~
−
−	~~A private key and a certificate request has been generated with the subject:~~
−	~~/O=Grid/O=NorduGrid/OU=nsc.liu.se/CN=Jens Larsson/Email=jens@nsc.liu.se~~
−
−	~~Send it to the local Registration Authority (RA) if any or directly to the Nordugrid CA at [mailto:ca@nordugrid.org ca@nordugrid.org]~~
−
−	~~==Getting a certificate without grid-cert-request==~~
−
−	~~If you don't have the grid tools available for creating the CSR, you can use OpenSSL directly. Modify OU and CN as necessary.~~
−
−	~~openssl req -new -newkey rsa:2048 \~~
−	~~-out usercert_request.pem -keyout userkey.pem \~~
−	~~-subj "/O=Grid/O=NorduGrid/OU=nsc.liu.se/CN=Kalle Kula/emailAddress=kalle@nsc.liu.se"~~

@@ Line 1: / Line 1: @@
 [[Category:Grid computing]]
-[[Category:Swestore]]
+[[Category:SweStore]]
-[[Category:Swestore user guide]]
+[[Category:SweStore user guide]]
 =Certificates=

← Older revision		Revision as of 07:31, 23 September 2011
Line 1:		Line 1:
	[[Category:Grid computing]]		[[Category:Grid computing]]
		+	[[Category:Swestore]]
		+	[[Category:Swestore user guide]]
	=Certificates=		=Certificates=

← Older revision		Revision as of 13:17, 8 July 2011
Line 1:		Line 1:
−	[[Category:Grid]]	+	[[Category:Grid computing]]
	=Certificates=		=Certificates=

← Older revision		Revision as of 13:37, 17 June 2011
Line 1:		Line 1:
		+	[[Category:Grid]]
	=Certificates=		=Certificates=