Preparing a client certificate - Revision history

Niklas Edmundsson (HPC2N): Swestore documentation moved

2023-02-08T09:57:33Z

Swestore documentation moved

Niklas Edmundsson (HPC2N): Use certs.p12 as name for uniformity between docs

2022-03-30T14:16:18Z

Use certs.p12 as name for uniformity between docs

Jens Larsson (NSC) at 09:40, 20 June 2016

2016-06-20T09:40:34Z

Jonas Lindemann (LUNARC): /* Uploading and conversion of the .p12 for your target machine */

2013-07-02T09:04:16Z

‎Uploading and conversion of the .p12 for your target machine

Niklas Edmundsson (HPC2N): Add up/back link to SweGrid.

2013-05-22T14:52:10Z

Add up/back link to SweGrid.

Niklas Edmundsson (HPC2N): chmod .globus

2013-05-17T07:28:22Z

chmod .globus

Lars Viklund (HPC2N): /* Uploading and conversion of the .p12 for your target machine */

2013-05-17T06:45:33Z

‎Uploading and conversion of the .p12 for your target machine

Niklas Edmundsson (HPC2N): Add categories

2013-04-23T13:54:11Z

Add categories

Niklas Edmundsson (HPC2N): Add "up/back"-link on top.

2013-04-23T13:46:50Z

Add "up/back"-link on top.

Lars Viklund (HPC2N): /* Uploading and conversion of the .p12 for your target machine */

2013-04-18T11:56:59Z

‎Uploading and conversion of the .p12 for your target machine

← Older revision		Revision as of 09:57, 8 February 2023
Line 1:		Line 1:
−	[[~~Category:Grid computing]]~~	+	#REDIRECT[[Swestore Documentation Moved]]
−	~~[[Category:SweGrid user guide]]~~
−	~~[[Category:Swestore]]~~
−	~~[[Category:Swestore user guide]]~~
−
−	~~[[Getting started with SweGrid\|< Getting started with SweGrid]]~~
−
−	~~[[Swestore\|<~~ Swestore]]
−
−	Most of the standalone third party tools installed on SNIC resources and your own machine will not be able to use a <tt>.p12</tt> certificate bundle (or <tt>.pfx</tt> if you exported from IE), as that format is intended primarily for secure transport and backup of certificates and their private keys.
−
−	~~Instead of a single <tt>.p12</tt> file, they expect a pair of files in <tt>.pem</tt> format, one containing the certificate and the other containing the private key that matches the certificate.~~
−
−	~~== Uploading and conversion of the .p12 for your target machine ==~~
−
−	~~As the authentication methods for clusters differ, this section will defer to documentations for your particular site when it comes to transferring files to and from the cluster storage.~~
−
−	~~The goal is to end up with a <tt>.globus</tt> directory in your home directory, containing two files named <tt>usercert.pem</tt> and <tt>userkey.pem</tt>.~~
−
−	The instructions below assume that your exported certificate file is named <tt>certs.p12</tt> directly in your home directory. If it's a <tt>.pfx</tt> or with a different name, change <tt>certs.p12</tt> in the instructions to your actual filename or rename your file to <tt>certs.p12</tt>.
−
−	* Transfer the <tt>certs.p12</tt> file to your home directory on the cluster.
−	* Get an interactive shell on the login node, via ssh.
−	* If an .globus directory already exists, rename it with something like
−	~~<tt>mv ~/.globus ~/.globus-old</tt>~~
−	* Create the directory with
−	~~<tt>mkdir ~/.globus</tt>~~
−	~~<tt>chmod 0700 ~/.globus</tt>~~
−	* Extract and protect the private key part of <tt>certs.p12</tt>:
−	~~openssl pkcs12 -nocerts -in ~/certs.p12 -out ~/.globus/userkey.pem~~
−	* When asked for import password, specify the password specified when exporting the certificate bundle from your browser. The PEM pass phrase should be a new password that you need to provide whenever using the certificate for tasks like generating a proxy certificate. The output from this command will be similar to the following:
−	Enter Import Password: *******
−	~~MAC verified OK~~
−	Enter PEM pass phrase: *******
−	Verifying - Enter PEM pass phrase: *******
−
−	* Extract the public client certificate part of <tt>certs.p12</tt>:
−	~~openssl pkcs12 -clcerts -nokeys -in ~/certs.p12 -out ~/.globus/usercert.pem~~
−	* The output will be similar to the following:
−	Enter Import Password: *******
−	~~MAC verified OK~~
−	* Finally ensure that only your user is allowed to read the private key file. This is important, both for security and due to some tools refusing to use private keys with insufficient restrictions.
−	~~chmod 0400 ~/.globus/userkey.pem~~

@@ Line 18: / Line 18: @@
 The goal is to end up with a <tt>.globus</tt> directory in your home directory, containing two files named <tt>usercert.pem</tt> and <tt>userkey.pem</tt>.
-The instructions below assume that your exported certificate file is named <tt>export.p12</tt> directly in your home directory. If it's a <tt>.pfx</tt> or with a different name, change <tt>export.p12</tt> in the instructions to your actual filename or rename your file to <tt>export.p12</tt>.
+The instructions below assume that your exported certificate file is named <tt>certs.p12</tt> directly in your home directory. If it's a <tt>.pfx</tt> or with a different name, change <tt>certs.p12</tt> in the instructions to your actual filename or rename your file to <tt>certs.p12</tt>.
-* Transfer the <tt>export.p12</tt> file to your home directory on the cluster.
+* Transfer the <tt>certs.p12</tt> file to your home directory on the cluster.
 * Get an interactive shell on the login node, via ssh.
 * If an .globus directory already exists, rename it with something like
@@ Line 27: / Line 27: @@
    <tt>mkdir ~/.globus</tt>
    <tt>chmod 0700 ~/.globus</tt>
-* Extract and protect the private key part of <tt>export.p12</tt>:
+* Extract and protect the private key part of <tt>certs.p12</tt>:
-   openssl pkcs12 -nocerts -in ~/export.p12 -out ~/.globus/userkey.pem
+   openssl pkcs12 -nocerts -in ~/certs.p12 -out ~/.globus/userkey.pem
 * When asked for import password, specify the password specified when exporting the certificate bundle from your browser. The PEM pass phrase should be a new password that you need to provide whenever using the certificate for tasks like generating a proxy certificate. The output from this command will be similar to the following:
    Enter Import Password: *******
@@ Line 35: / Line 35: @@
    Verifying - Enter PEM pass phrase: *******
-* Extract the public client certificate part of <tt>export.p12</tt>:
+* Extract the public client certificate part of <tt>certs.p12</tt>:
-   openssl pkcs12 -clcerts -nokeys -in ~/export.p12 -out ~/.globus/usercert.pem
+   openssl pkcs12 -clcerts -nokeys -in ~/certs.p12 -out ~/.globus/usercert.pem
 * The output will be similar to the following:
    Enter Import Password: *******

@@ Line 1: / Line 1: @@
 [[Category:Grid computing]]
 [[Category:SweGrid user guide]]
-[[Category:SweStore]]
+[[Category:Swestore]]
-[[Category:SweStore user guide]]
+[[Category:Swestore user guide]]
 [[Getting started with SweGrid|< Getting started with SweGrid]]
-[[SweStore|< SweStore]]
+[[Swestore|< Swestore]]
 Most of the standalone third party tools installed on SNIC resources and your own machine will not be able to use a <tt>.p12</tt> certificate bundle (or <tt>.pfx</tt> if you exported from IE), as that format is intended primarily for secure transport and backup of certificates and their private keys.

@@ Line 36: / Line 36: @@
 * Extract the public client certificate part of <tt>export.p12</tt>:
-   openssl pkcs12 -clcerts -nokeys -in ~/export.p12 -out ~/globus/usercert.pem
+   openssl pkcs12 -clcerts -nokeys -in ~/export.p12 -out ~/.globus/usercert.pem
 * The output will be similar to the following:
    Enter Import Password: *******

@@ Line 3: / Line 3: @@
 [[Category:SweStore]]
 [[Category:SweStore user guide]]
 [[SweStore|< SweStore]]

@@ Line 13: / Line 13: @@
 As the authentication methods for clusters differ, this section will defer to documentations for your particular site when it comes to transferring files to and from the cluster storage.
-The goal is to end up with a <tt>.globus</tt> directory in your home directory, containing two files named <tt>usercert.pem</tt> and <tt>userkey.pem</tt>. The instructions below assume that your exported certificate file is named <tt>export.p12</tt> directly in your home directory. If it's a <tt>.pfx</tt> or with a different name, adjust accordingly.
+The goal is to end up with a <tt>.globus</tt> directory in your home directory, containing two files named <tt>usercert.pem</tt> and <tt>userkey.pem</tt>.
 * Transfer the <tt>export.p12</tt> file to your home directory on the cluster.

← Older revision		Revision as of 13:54, 23 April 2013
Line 1:		Line 1:
		+	[[Category:Grid computing]]
		+	[[Category:SweGrid user guide]]
		+	[[Category:SweStore]]
		+	[[Category:SweStore user guide]]
	[[SweStore\|< SweStore]]		[[SweStore\|< SweStore]]

← Older revision		Revision as of 13:46, 23 April 2013
Line 1:		Line 1:
		+	[[SweStore\|< SweStore]]
		+
	Most of the standalone third party tools installed on SNIC resources and your own machine will not be able to use a <tt>.p12</tt> certificate bundle (or <tt>.pfx</tt> if you exported from IE), as that format is intended primarily for secure transport and backup of certificates and their private keys.		Most of the standalone third party tools installed on SNIC resources and your own machine will not be able to use a <tt>.p12</tt> certificate bundle (or <tt>.pfx</tt> if you exported from IE), as that format is intended primarily for secure transport and backup of certificates and their private keys.