With the Globus toolkit installed on nodeA and your CA files installed you can now request a certificate for a generic user on your nodeA. We will use 'jane' as the generic user account.

Begin by becoming user jane:

[root@nodeA i386]# su - jane
[jane@nodeA ~]$ whoami
jane

As usual, before running any Globus Toolkit commands the user needs to set up her environment:

[jane@nodeA ~]$ export GLOBUS_LOCATION=/opt/globus-4.0.1
[jane@nodeA ~]$ source $GLOBUS_LOCATION/etc/globus-user-env.sh

Note I used a PEM pass phrase for jane same as Unix password: janeuser

Now use the 'grid-cert-request' script with no arguments to create a request for user jane. When prompted enter a password or pass phrase for the password that will protect user jane's credentials:

[jane@nodeA ~]$ grid-cert-request

A certificate request and private key is being created. You will be asked to enter a PEM pass phrase. This pass phrase is akin to your account password, and is used to protect your key file. If you forget your pass phrase, you will need to obtain a new certificate.

Generating a 1024 bit RSA private key
........++++++
...........++++++
writing new private key to '/home/jane/.globus/userkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value, if you enter '.', the field will be left blank.

Level 0 Organization [Grid]:Level 0 Organizational Unit [GlobusTest]:Level 1 Organizational Unit [ps.univa.com]:Name (e.g., John M. Smith) []:

A private key and a certificate request has been generated with the subject:
/O=Grid/OU=GlobusTest/OU=ps.univa.com/CN=Jane User

If the CN=Jane User is not appropriate, rerun this script with the -force -cn "Common Name" options.

Your private key is stored in /home/jane/.globus/userkey.pem
Your request is stored in /home/jane/.globus/usercert_request.pem

Please e-mail the request to the Test01 root@nodeb.ps.univa.com
You may use a command similar to the following:
cat /home/jane/.globus/usercert_request.pem | mail root@nodeb.ps.univa.com

Only use the above if this machine can send AND receive e-mail. if not, please mail using some other method.

Your certificate will be mailed to you within two working days. If you receive no response, contact Test01 at root@nodeb.ps.univa.com

Ignore the instructions about emailing the certificate request. Instead you will act now to get the certificate request signed. First make sure the request was generated:

[jane@nodeA ~]$ ls -l .globus/usercert_request.pem
-rw-r--r-- 1 jane users 1346 Feb 23 10:41 .globus/usercert_request.pem

To sign the certificate we will copy the request from nodeA to nodeB, sign the certificate as user 'globus' (since globus owns the CA), and then return the signed certificate to user jane's account.

Begin by going to nodeB and copying over the certificate request for user jane:

[globus@nodeB ~]$ cd .globus/simpleCA/
[globus@nodeB simpleCA]$ scp root@nodea:/home/jane/.globus/usercert_request.pem .
root@nodea's password:
usercert_request.pem 100% 1346 1.3KB/s 00:00

Now use the 'grid-ca-sign' command to sign the certificate. You will need to enter the password that protect the CA (not the password for user jane's private key):

[globus@nodeB simpleCA]$ grid-ca-sign -in ./usercert_request.pem -out ./usercert.pem

To sign the request please enter the password for the CA key:

The new signed certificate is at: /home/globus/.globus/simpleCA//newcerts/02.pem

With the certificate signed you can go back to nodeA and grab it from nodeB:

[jane@nodeA ~]$ scp root@nodeb:/home/globus/.globus/simpleCA/usercert.pem $HOME/.globus/usercert.pem
The authenticity of host 'nodeb (192.168.31.40)' can't be established.
RSA key fingerprint is 1d:ff:38:57:0d:70:f8:5d:5e:f2:26:4b:d3:49:d9:79.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'nodeb,192.168.31.40' (RSA) to the list of known hosts.
root@nodeb's password:
usercert.pem 100% 2534 2.5KB/s 00:00

Check to make sure that user jane's certificate is owned by user jane and has the correct permissions:

[jane@nodeA ~]$ ls -alh .globus/usercert.pem
-rw-r--r-- 1 jane users 2.5K Feb 23 11:39 .globus/usercert.pem

< Back Next >