The gLite User Guide describes how certificates are used in the grid middle-ware.
There is also the 'PeCR' bulk system, which you can use to make requests for multiple certificates from the command line.
Systems administrators may also be interested in the commandline CertSorcerer tool.
A few notes about doing stuff with/to certificates:
Unpacking a host certificate (from the exported/backed up .pfx/.p12 file you got from the CA)
Do this in /etc/grid-security
# openssl pkcs12 -nocerts -nodes -in <CERT> -out hostkey.pem # chmod 400 hostkey.pem # openssl pkcs12 -clcerts -nokeys -in <CERT> -out hostcert.pem # chmod 444 hostcert.pem
Checking a host certificate
# openssl x509 -in <CERT> -noout -text
N.B. A machine certificate has a common name (CN) which contains the hostname e.g., CN=grid07.ph.gla.ac.uk. A personal certificate has the common name of the user, e.g., CN=graeme stewart.
See also Subject Alternative Name for host certificates.
Converting a Certificate back into P12 Form
openssl pkcs12 -export -in hostcert.pem -inkey hostkey.pem -out bundle.p12
You can add a passphrase if necessary. (Or add the option -passout pass: to suppress the passphrase dialogue.)
The CA permits (or will permit shortly) three different types of private keys.
- Encrypted software keys (encrypted with a "strong" passphrase) - used for user keys. Proxies are used to "unlock" the key over a period of time.
- Unencrypted software keys - normally used for host keys, or for "softkey" robot certificates. As the key (file) itself is not protected by a passphrase, it must have other means of preventing being stolen or otherwise used in an unauthorised way.
- KeyTokens, a hardware module which protects the private key from theft.