Draft - being reviewed

Getting X.509 certificates from the DOE Science Grid CA

Requesting a user certificate

• If you are running more than one copy of your browser, please bring them all down and start a fresh browser session. Otherwise you may not be able to reference the browser's certificate and key data bases.

 

• This procedure of requesting a user certificate has been tested from recent releases of both Netscape (4.7) and IE (5.+). Netscape requires JavaScript to be enabled and the IE requires activeX. If you get errors accessing the URL or when submitting your request, please check your browser settings.

   

• Importing the CA certificate into your browser
  If this is the first time you have used this CA, we recommend that you import its certificate into your browser as a trusted signer. This will prevent your browser from giving you warning messages about untrusted signers whenever you reference it. To do this point your browser at http://pki1.doesciencegrid.org
  • Go to the retrieval tag
  • choose Import CA Certificate Chain from the menu.
  • the radio button under Users Import certificate chain into your browser should be set. Then click the submit button.
  • To check that it worked,
    • in Netscape click the security button on the tool bar.
    • go to certificates, signer
    • scroll down until you find pki1 and select it.
    • click edit which will display the certificate.
    • If you want to be completely sure that you got the right certificate go to http://envisage.es.net and check that the MD5 fingerprint of the CN=pki1 certificate matches the one in your browser.
• Requesting your certificate.
  Point your browser to https://pki1.doesciencegrid.org
• Choose Enrollment tab.
• Fill in the Manual User Enrollment Form.
Items to enter in the certificate
• Full name : Your full name. (First Name, Middle initial, Last Name.)
• Email : Fill in this field if you plan to use this certificate for secure email.
• Information used while processing your request
  • Email : Fill in this field so that we can inform you when your certificate has been issued.
  • Phone : Please provide your correct phone number with area code if you wish to be notified by phone in case there is some problem with your certificate request.
  • Sponsor Information This information is used to identify what virtual organization you belong to. This CA supports several SciDAC projects and the sponsor information will be used to direct this request to the RA for your project, who will contact your sponsor to authenticate your request. The list of sponsors can be found at each site. If your name is not recognized by your project's RA, he will contact the sponsor. In the affiliation field you should list your home institution followed by your virtual organization. eg. LBNL - DOESG, FNL - PPDG or MIT - Fusion Collaboratory
  • Additional Comments : If you are member of PPDG, please indicate which experiment or CS group you are participating in.
  • For Netscape browsers:
    • Key Length : Choose 1024 (High Grade).
  • For IE:
    • Cryptographic provider: Choose Microsoft Enhanced
• At this point you will be taken to a new browser window and will be informed that a new private key will be generated for you. Clicking OK in that screen will take you to a next screen where you will be asked to type in a password. This password is your browser certificate database password. If you lose your password you lose access to all your certificates. If you are not taken to a screen to get a password, then you might have already typed in a password in your browser.
• Retrieving your certificate.
  When your certificate has been successfully issued, you will receive an email that contains a link to a page containing all your certificate information. Open that page in your browser and click on Import Your Certificate button at the bottom of that page.

Exporting your certificate for use by Globus proxy-init.

• If you need to use your certificate outside your browser, or import it into a different browser, you can export it as PKCS 12 file. To do this click on your Security button in your browser, go to Certificate, Yours, select the certificate that you wish to export and click the Export button. At the time of this export, you will asked to type a password. This is used to encrypt the PKCS 12 file. This is a standard format file containing a certificate, public and private key.

 

• grid-proxy-init of Globus wants two separate files : A PEM encoded X509 certificate and a PEM encoded RSA encrypted private key. The following two incantations of openssl will produce these files.
  • To get your X509 certificate (no chaining) :
    openssl pkcs12 -in YourCert.p12 -clcerts -nokeys -out $HOME/.globus/usercert.pem
  • To get the encrypted private key :
    openssl pkcs12 -in YourCert.p12 -nocerts -out $HOME/.globus/userkey.pem
    You must set the mode on your userkey.pem file to read/write only by the owner, otherwise grid-proxy-init will not use it.

Getting the CA certificates for use by Globus

There are several ways to get the CA certificate and put it in /etc/grid-security/certificates where Globus uses it to verify certificates.
• There is a tar file that contains it along with an appropriate ca_signing policy and some other configuration files.
• Or you can download it from https://pki.doesciencegrid.org
• Go to the retrieval tag
• choose Import CA Certificate Chain from the menu.
• Under Administrators, select "Display certificates in the CA certificate chain for importing individually into a server"
• click submit
• cut and paste the Certificate for CN=pki1 including the lines -----BEGIN CERTIFICATE--- and -----END CERTIFICATE----- into /etc/grid-security/certificates/9d8753eb.0
• cut and paste the Certificate for CN=Certificate Manager including the lines -----BEGIN CERTIFICATE--- and -----END CERTIFICATE----- into /etc/grid-security/certificates/6349a761.0

Requesting a host or service certificate

• To get a certificate for a Globus host, start with the Grid tool globus/tools/<platform>/bin/grid-cert-request to generate a pkcs10 certificate request.

  grid-cert-request -host <fully qualified domain name> -dir $HOME

  To get a certificate for a service running on a particular host

  grid-cert-request -service <Service name> -host <fully qualified domain name> -dir $HOME

  This will create the following files in $HOME (or whatever directory you specify): usercert_request.pem which contains the PCKS10 request; an empty usercert.pem file; and a userkey.pem file which contains the private key for the certificate.

   

• Point your browser to https://pki1.doesciencegrid.org and choose the menu choice Grid or SSL Server under the Server category.

   

• Cut and paste the certificate request - Starting with the line -----BEGIN CERTIFICATE REQUEST----- up to and including the line -----END CERTIFICATE REQUEST----- generated by grid-cert-request. Fill in your name, email and phone number and submit the form.

   

• When the CA has signed your certificate, you will receive an email message which contains a URL to the certificate. Follow that and and cut and paste the "Base64 encoded certificate" into the file usercert.pem. You then need to install these files where the software can find them. In the case of host certificates it is in /etc/grid-security with the names hostcert.pem and hostkey.pem. For other server certificates, it is wherever your server wants it to be.