Requesting a grid certificate from the Nordugrid CA

< Grid certificates

The first step in acquiring a certificate from the nordugrid CA is to create a certificate request.

Creating a certificate request using the ARC tools

This is done using the grid-cert-request -int command. (The -int options means interactive usage). When issued, the tool will generate a certificate request and a private key. The tool will also ask for a password to protect the private key. Note, if the password is lost a new certificate must be obtained. The process is shown below:

First the private key is generated:

$ grid-cert-request -int
A certificate request and private key is being created.
You will be asked to enter a PEM pass phrase.
This pass phrase is akin to your account password,
and is used to protect your key file.
If you forget your pass phrase, you will need to
obtain a new certificate.

Using configuration from /etc/grid-security/globus-user-ssl.conf
Generating a 1024 bit RSA private key
.....................................++++++
....................++++++
writing new private key to '/home/jonas/.globus/userkey.pem'

To protect the private key from unauthorized access it is encrypted using a pass phrase. If this pass phrase is empty, anyone with access to your private key and certificate can gain access to the resources you have been granted. The pass phrase should also be different from your normal login password, so if your local system has been compromised the private key is still protected.:

-----
You are about to be asked to enter information that will be
incorporated into your certificate request. What you are about to
enter is what is called a Distinguished Name or a DN. There are
quite a few fields but you can leave some blank For some fields
there will be a default value, If you enter '.', the field will be
left blank.
-----
Level 0 Organization Name (do not modify) [Grid]:
Level 1 Organization Name (do not modify) [NorduGrid]:

The following questions regards your affiliation domain and your email. It is important that your domain and the domain in the email address is the same.:

Your Domain [example.org]:mydomain.org
Name (e.g., Hans Christian Andersen) []:Joe User
Email address (e.g., h.c.andersen@example.org) []:joe.user@
mydomain.org

Finally the private key and a certificate request are generated.:

A private key and a certificate request has been generated with
the subject:

/O=Grid/O=NorduGrid/OU=mydomain.org/CN=Joe User/Email=joe.user@
mydomain.org

If the CN=Joe User/Email=joe.user@mydomain.org is not appropriate,
rerun this script with the -force -cn "Common Name" options.

Your private key is stored in /home/joe/.globus/userkey.pem
Your request is stored in /home/joe/.globus/usercert_request.pem

Please e-mail the request to the NorduGrid Certification Authority
ca@nbi.dk You may use a command similar to the following:

  cat /home/jonas/.globus/usercert_request.pem | mail ca@nbi.dk

Only use the above if this machine can send AND receive e-mail. if
not, please mail using some other method.

Your certificate will be mailed to you within two working days. If
you receive no response, contact NorduGrid Certification Authority
at ca@nbi.dk

Creating a certificate request using openssl

If grid-proxy-init isn't available you can use openssl to create a certificate request and a private key. Openssl will ask for a password to protect the private key. Note, if the password or private key is lost, a new certificate must be obtained. The process is shown below:

$ mkdir -p ~/.globus
$ openssl req -new -newkey rsa:2048 \
  -out ~/.globus/usercert_request.pem \
  -keyout ~/.globus/userkey.pem \
  -subj "/O=Grid/O=NorduGrid/OU=nsc.liu.se/CN=Kalle Kula/emailAddress=kalle@nsc.liu.se"
Generating a 2048 bit RSA private key
.........+++
.....................+++
writing new private key to '~/.globus/userkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----

Modify OU, CN and emailAddress as necessary. It is probably important that your OU and the domain in the email address are the same.

Sending the certificate request to the Nordugrid CA

When the certificate request is created there will be 2 files, userkey.pem and usercert_request.pem, in a subdirectory called .globus in your home directory. The userkey.pem is your private key and should not be world readable. This can be achieved by using chmod 400 ~/.globus/userkey.pem.

The contents of the usercert_request.pem should be sent by mail to you neareast Registration Authority (RA). The RA will verify your request and verify your identity. This can involve meeting with the RA and proving your identity with a passport or equivalent documents. The current list of RA:s can be found at the following page:

http://ca.nordugrid.org/ra.html

Installing the certificate in your home directory

When certificate request is signed by the CA you will receive a mail with the certificate.

The important parts of the mail are shown below::

-----BEGIN CERTIFICATE-----
MIIDKDCCApGgAwIBAgICFAgwDQYJKoZIhvcNAQEFBQAwTzENMAsGA1UEChMER3Jp
ZDESMBAGA1UEChMJTm9yZHVHcmlkMSowKAYDVQQDEyFOb3JkdUdyaWQgQ2VydGlm
...
-----END CERTIFICATE-----

Copy the part shown above into the file usercert.pem in the .globus directory in your home directory.

Installing the certificate in your browser

To use the requested certificate in your browser it has to be converted to pkcs12 format. This can be done using the following commands (on a linux/unix based system):

$ cd ~/.globus
$ openssl pkcs12 -export -in usercert.pem -inkey userkey.pem -out usercert.p12

First openssl ask for your passphrase for your private key.

Enter pass phrase for userkey.pem:

As the pkcs12 file will consist of both your public and private key, the generated file is protected by an additional passphrase which openssl asks for:

Enter Export Password:
Verifying - Enter Export Password:

The generated file, usercert.p12, can then be imported in Firefox by opening the Preferences dialog. Clicking on the "Advanced" and then selecting the "Encryption" tab. In this tab there is a button "Certificates". Click this button and then the "Import..." button to select the generated pkcs12 file. Firefox will then ask you for the export passphrase to entered in the openssl command.